5918 lines
141 KiB
HTML
5918 lines
141 KiB
HTML
|
|
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
|
|
<HTML><HEAD><TITLE>Man page of LSOF</TITLE>
|
|
</HEAD><BODY>
|
|
<H1>LSOF</H1>
|
|
Section: Maintenance Commands (8)<BR>Updated: Revision-4.93.2<BR><A HREF="#index">Index</A>
|
|
<A HREF="/cgi-bin/man/man2html">Return to Main Contents</A><HR>
|
|
|
|
|
|
|
|
|
|
|
|
|
|
<A NAME="lbAB"> </A>
|
|
<H2>NAME</H2>
|
|
|
|
lsof - list open files
|
|
<A NAME="lbAC"> </A>
|
|
<H2>SYNOPSIS</H2>
|
|
|
|
<B>lsof</B>
|
|
|
|
[
|
|
<B>-?abChlnNOPRtUvVX</B>
|
|
|
|
] [
|
|
<B>-A</B><I> A</I>
|
|
|
|
] [
|
|
<B>-c</B><I> c</I>
|
|
|
|
] [
|
|
<B>+c</B><I> c</I>
|
|
|
|
] [
|
|
<B>+|-d</B><I> d</I>
|
|
|
|
] [
|
|
<B>+|-D</B><I> D</I>
|
|
|
|
] [
|
|
<B>+|-e</B><I> s</I>
|
|
|
|
] [
|
|
<B>+|-E</B>
|
|
|
|
] [
|
|
<B>+|-f [cfgGn]</B>
|
|
|
|
] [
|
|
<B>-F</B><I> [f]</I>
|
|
|
|
] [
|
|
<B>-g</B><I> [s]</I>
|
|
|
|
] [
|
|
<B>-i</B><I> [i]</I>
|
|
|
|
] [
|
|
<B>-k</B><I> k</I>
|
|
|
|
] [
|
|
<B>-K</B><I> k</I>
|
|
|
|
] [
|
|
<B>+|-L</B><I> [l]</I>
|
|
|
|
] [
|
|
<B>+|-m</B><I> m</I>
|
|
|
|
] [
|
|
<B>+|-M</B>
|
|
|
|
] [
|
|
<B>-o</B><I> [o]</I>
|
|
|
|
] [
|
|
<B>-p</B><I> s</I>
|
|
|
|
] [
|
|
<B>+|-r</B><I> [t[m<fmt>]]</I>
|
|
|
|
] [
|
|
<B>-s</B><I> [p:s]</I>
|
|
|
|
] [
|
|
<B>-S</B><I> [t]</I>
|
|
|
|
] [
|
|
<B>-T</B><I> [t]</I>
|
|
|
|
] [
|
|
<B>-u</B><I> s</I>
|
|
|
|
] [
|
|
<B>+|-w</B>
|
|
|
|
] [
|
|
<B>-x</B><I> [fl]</I>
|
|
|
|
] [
|
|
<B>-z</B><I> [z]</I>
|
|
|
|
] [
|
|
<B>-Z</B><I> [Z]</I>
|
|
|
|
] [
|
|
<B>--</B>
|
|
|
|
] [<I>names</I>]
|
|
<A NAME="lbAD"> </A>
|
|
<H2>DESCRIPTION</H2>
|
|
|
|
<I>Lsof</I>
|
|
|
|
revision 4.93.2 lists on its standard output file information about files
|
|
opened by processes for the following UNIX dialects:
|
|
<P>
|
|
|
|
<PRE>
|
|
Apple Darwin 9 and Mac OS X 10.[567]
|
|
FreeBSD 8.[234], 9.0 and 1[012].0 for AMD64-based systems
|
|
Linux 2.1.72 and above for x86-based systems
|
|
Solaris 9, 10 and 11
|
|
</PRE>
|
|
|
|
<P>
|
|
|
|
(See the
|
|
<B>DISTRIBUTION</B>
|
|
|
|
section of this manual page for information on how to obtain the
|
|
latest
|
|
<I>lsof</I>
|
|
|
|
revision.)
|
|
<P>
|
|
|
|
An open file may be a regular file, a directory, a block special file,
|
|
a character special file, an executing text reference, a library,
|
|
a stream or a network file (Internet socket, NFS file or UNIX domain socket.)
|
|
A specific file or all the files in a file system may be selected by path.
|
|
<P>
|
|
|
|
Instead of a formatted display,
|
|
<I>lsof</I>
|
|
|
|
will produce output that can be parsed by other programs.
|
|
See the
|
|
<B>-F</B>,
|
|
|
|
option description, and the
|
|
<B>OUTPUT FOR OTHER PROGRAMS</B>
|
|
|
|
section for more information.
|
|
<P>
|
|
|
|
In addition to producing a single output list,
|
|
<I>lsof</I>
|
|
|
|
will run in repeat mode.
|
|
In repeat mode it will produce output, delay, then repeat the output
|
|
operation until stopped with an interrupt or quit signal.
|
|
See the
|
|
<B>+|-r</B><I> [t[m<fmt>]]</I>
|
|
|
|
option description for more information.
|
|
<A NAME="lbAE"> </A>
|
|
<H2>OPTIONS</H2>
|
|
|
|
In the absence of any options,
|
|
<I>lsof</I>
|
|
|
|
lists all open files belonging to all active processes.
|
|
<P>
|
|
|
|
If any list request option is specified, other list requests must be
|
|
specifically requested - e.g., if
|
|
<B>-U</B>
|
|
|
|
is specified for the listing of UNIX socket files, NFS files won't be
|
|
listed unless
|
|
<B>-N</B>
|
|
|
|
is also specified;
|
|
or if a user list is specified with the
|
|
<B>-u</B>
|
|
|
|
option, UNIX domain socket files, belonging to users not in the list,
|
|
won't be listed unless the
|
|
<B>-U</B>
|
|
|
|
option is also specified.
|
|
<P>
|
|
|
|
Normally list options that are specifically stated are ORed - i.e.,
|
|
specifying the
|
|
<B>-i</B>
|
|
|
|
option without an address and the <B>-u</B>foo option produces a
|
|
listing of all network files OR files belonging to processes owned
|
|
by user ``foo''.
|
|
The exceptions are:
|
|
<DL COMPACT>
|
|
<DT id="1">1)<DD>
|
|
the `^' (negated) login name or user ID (UID), specified with the
|
|
<B>-u</B>
|
|
|
|
option;
|
|
<DT id="2">2)<DD>
|
|
the `^' (negated) process ID (PID), specified with the
|
|
<B>-p</B>
|
|
|
|
option;
|
|
<DT id="3">3)<DD>
|
|
the `^' (negated) process group ID (PGID), specified with the
|
|
<B>-g</B>
|
|
|
|
option;
|
|
<DT id="4">4)<DD>
|
|
the `^' (negated) command, specified with the
|
|
<B>-c</B>
|
|
|
|
option;
|
|
<DT id="5">5)<DD>
|
|
the (`^') negated TCP or UDP protocol state names, specified with the
|
|
<B>-s</B><I> [p:s]</I>
|
|
|
|
option.
|
|
</DL>
|
|
<P>
|
|
|
|
Since they represent exclusions, they are applied without ORing or ANDing
|
|
and take effect before any other selection criteria are applied.
|
|
<P>
|
|
|
|
The
|
|
<B>-a</B>
|
|
|
|
option may be used to AND the selections.
|
|
For example, specifying
|
|
<B>-a</B>,
|
|
|
|
<B>-U</B>,
|
|
|
|
and <B>-u</B>foo produces a listing of only UNIX socket files that
|
|
belong to processes owned by user ``foo''.
|
|
<P>
|
|
|
|
Caution: the
|
|
<B>-a</B>
|
|
|
|
option causes all list selection options to be ANDed; it can't
|
|
be used to cause ANDing of selected pairs of selection options
|
|
by placing it between them, even though its placement there is
|
|
acceptable.
|
|
Wherever
|
|
<B>-a</B>
|
|
|
|
is placed, it causes the ANDing of all selection options.
|
|
<P>
|
|
|
|
Items of the same selection set - command names, file descriptors,
|
|
network addresses, process identifiers, user identifiers, zone names,
|
|
security contexts - are joined in a single ORed set and applied
|
|
before the result participates in ANDing.
|
|
Thus, for example, specifying <B>-i</B>@aaa.bbb, <B>-i</B>@ccc.ddd,
|
|
<B>-a</B>,
|
|
|
|
and <B>-u</B>fff,ggg will select the listing of files that belong to
|
|
either login ``fff'' OR ``ggg'' AND have network connections to either
|
|
host aaa.bbb OR ccc.ddd.
|
|
<P>
|
|
|
|
Options may be grouped together following a single prefix -- e.g.,
|
|
the option set ``<B>-a -b -C</B>'' may be stated as
|
|
<B>-abC</B>.
|
|
|
|
However, since values are optional following
|
|
<B>+|-f</B>,
|
|
|
|
<B>-F</B>,
|
|
|
|
<B>-g</B>,
|
|
|
|
<B>-i</B>,
|
|
|
|
<B>+|-L</B>,
|
|
|
|
<B>-o</B>,
|
|
|
|
<B>+|-r</B>,
|
|
|
|
<B>-s</B>,
|
|
|
|
<B>-S</B>,
|
|
|
|
<B>-T</B>,
|
|
|
|
<B>-x</B>
|
|
|
|
and
|
|
<B>-z</B>.
|
|
|
|
when you have no values for them be careful that the
|
|
following character isn't ambiguous.
|
|
For example,
|
|
<B>-Fn</B>
|
|
|
|
might represent the
|
|
<B>-F</B>
|
|
|
|
and
|
|
<B>-n</B>
|
|
|
|
options, or it might represent the
|
|
<B>n</B>
|
|
|
|
field identifier character following the
|
|
<B>-F</B>
|
|
|
|
option.
|
|
When ambiguity is possible, start a new option with a `-'
|
|
character - e.g., ``<B>-F -n</B>''.
|
|
If the next option is a file name, follow the possibly ambiguous
|
|
option with ``--'' - e.g., ``<B>-F -- </B><I>name</I>''.
|
|
<P>
|
|
|
|
Either the `+' or the `-' prefix may be applied to a group of options.
|
|
Options that don't take on separate meanings for each
|
|
prefix - e.g., <B>-i</B> - may be grouped under either prefix.
|
|
Thus, for example, ``+M -i'' may be stated as ``+Mi'' and the group
|
|
means the same as the separate options.
|
|
Be careful of prefix grouping when one or more options in the group
|
|
does take on separate meanings under different prefixes -
|
|
e.g., <B>+|-M</B>; ``-iM'' is not the same request as ``-i +M''.
|
|
When in doubt, use separate options with appropriate prefixes.
|
|
<DL COMPACT>
|
|
<DT id="6"><B>-? -h</B>
|
|
|
|
<DD>
|
|
These two equivalent options select a usage (help) output list.
|
|
<I>Lsof</I>
|
|
|
|
displays a shortened form of this output when it detects an error
|
|
in the options supplied to it, after it has displayed messages
|
|
explaining each error.
|
|
(Escape the `?' character as your shell requires.)
|
|
<DT id="7"><B>-a</B>
|
|
|
|
<DD>
|
|
causes list selection options to be ANDed, as described above.
|
|
<DT id="8"><B>-A</B><I> A</I>
|
|
|
|
<DD>
|
|
is available on systems configured for AFS whose AFS
|
|
kernel code is implemented via dynamic modules.
|
|
It allows the
|
|
<I>lsof</I>
|
|
|
|
user to specify
|
|
<I>A</I>
|
|
|
|
as an alternate name list file where the kernel addresses of the dynamic
|
|
modules might be found.
|
|
See the
|
|
<I>lsof</I>
|
|
|
|
FAQ (The <B>FAQ</B> section gives its location.)
|
|
for more information about dynamic modules, their
|
|
symbols, and how they affect
|
|
<I>lsof</I>.
|
|
|
|
<DT id="9"><B>-b</B>
|
|
|
|
<DD>
|
|
causes
|
|
<I>lsof</I>
|
|
|
|
to avoid kernel functions that might block -
|
|
<I><A HREF="/cgi-bin/man/man2html?2+lstat">lstat</A></I>(2),
|
|
|
|
<I><A HREF="/cgi-bin/man/man2html?2+readlink">readlink</A></I>(2),
|
|
|
|
and
|
|
<I><A HREF="/cgi-bin/man/man2html?2+stat">stat</A></I>(2).
|
|
|
|
<DT id="10"><DD>
|
|
See the
|
|
<B>BLOCKS AND TIMEOUTS</B>
|
|
|
|
and
|
|
<B>AVOIDING KERNEL BLOCKS</B>
|
|
|
|
sections for information on using this option.
|
|
<DT id="11"><B>-c</B><I> c</I>
|
|
|
|
<DD>
|
|
selects the listing of files for processes executing the
|
|
command that begins with the characters of
|
|
<I>c</I>.
|
|
|
|
Multiple commands may be specified, using multiple
|
|
<B>-c</B>
|
|
|
|
options.
|
|
They are joined in a single ORed set before participating in
|
|
AND option selection.
|
|
<DT id="12"><DD>
|
|
If
|
|
<I>c</I>
|
|
|
|
begins with a `^', then the following characters specify a command
|
|
name whose processes are to be ignored (excluded.)
|
|
<DT id="13"><DD>
|
|
If
|
|
<I>c</I>
|
|
|
|
begins and ends with a slash ('/'), the characters between the slashes
|
|
are interpreted as a regular expression.
|
|
Shell meta-characters in the regular expression must be quoted to prevent
|
|
their interpretation by the shell.
|
|
The closing slash may be followed by these modifiers:
|
|
<DT id="14"><DD>
|
|
<PRE>
|
|
b the regular expression is a basic one.
|
|
<BR>
|
|
i ignore the case of letters.
|
|
<BR>
|
|
x the regular expression is an extended one
|
|
<BR>
|
|
(default).
|
|
</PRE>
|
|
|
|
<DT id="15"><DD>
|
|
See the
|
|
<I>lsof</I>
|
|
|
|
FAQ (The <B>FAQ</B> section gives its location.)
|
|
for more information on basic and extended regular
|
|
expressions.
|
|
<DT id="16"><DD>
|
|
The simple command specification is tested first.
|
|
If that test fails, the command regular expression is applied.
|
|
If the simple command test succeeds, the command regular expression
|
|
test isn't made.
|
|
This may result in ``no command found for regex:'' messages
|
|
when lsof's
|
|
<B>-V</B>
|
|
|
|
option is specified.
|
|
<DT id="17"><B>+c</B><I> w</I>
|
|
|
|
<DD>
|
|
defines the maximum number of initial characters of the name,
|
|
supplied by the UNIX dialect, of the UNIX command associated with a process
|
|
to be printed in the COMMAND column.
|
|
(The
|
|
<I>lsof</I>
|
|
|
|
default is nine.)
|
|
<DT id="18"><DD>
|
|
Note that many UNIX dialects do not supply all command name characters
|
|
to
|
|
<I>lsof</I>
|
|
|
|
in the files and structures from which
|
|
<I>lsof</I>
|
|
|
|
obtains command name.
|
|
Often dialects limit the number of characters supplied in those sources.
|
|
For example, Linux 2.4.27 and Solaris 9 both limit command name length to
|
|
16 characters.
|
|
<DT id="19"><DD>
|
|
If
|
|
<I>w</I>
|
|
|
|
is zero ('0'), all command characters supplied to
|
|
<I>lsof</I>
|
|
|
|
by the UNIX dialect will be printed.
|
|
<DT id="20"><DD>
|
|
If
|
|
<I>w</I>
|
|
|
|
is less than the length of the column title, ``COMMAND'', it will
|
|
be raised to that length.
|
|
<DT id="21"><B>-C</B>
|
|
|
|
<DD>
|
|
disables the reporting of any path name
|
|
components from the kernel's name cache.
|
|
See the
|
|
<B>KERNEL NAME CACHE</B>
|
|
|
|
section for more information.
|
|
<DT id="22"><B>+d</B><I> s</I>
|
|
|
|
<DD>
|
|
causes
|
|
<I>lsof</I>
|
|
|
|
to search for all open instances of directory
|
|
<I>s</I>
|
|
|
|
and the files and directories it contains at its top level.
|
|
<B>+d</B>
|
|
|
|
does NOT descend the directory tree, rooted at
|
|
<I>s</I>.
|
|
|
|
The
|
|
<B>+D</B><I> D</I>
|
|
|
|
option may be used to request a full-descent directory tree search,
|
|
rooted at directory
|
|
<I>D</I>.
|
|
|
|
<DT id="23"><DD>
|
|
Processing of the
|
|
<B>+d</B>
|
|
|
|
option does not follow symbolic links within
|
|
<I>s</I>
|
|
|
|
unless the
|
|
<B>-x</B>
|
|
|
|
or
|
|
<B>-x l</B>
|
|
|
|
option is also specified.
|
|
Nor does it
|
|
search for open files on file system mount points on subdirectories of
|
|
<I>s</I>
|
|
|
|
unless the
|
|
<B>-x</B>
|
|
|
|
or
|
|
<B>-x f</B>
|
|
|
|
option is also specified.
|
|
<DT id="24"><DD>
|
|
Note: the authority of the user of this option limits it to searching for
|
|
files that the user has permission to examine with the system
|
|
<I><A HREF="/cgi-bin/man/man2html?2+stat">stat</A></I>(2)
|
|
|
|
function.
|
|
<DT id="25"><B>-d</B><I> s</I>
|
|
|
|
<DD>
|
|
specifies a list of file descriptors (FDs) to exclude from
|
|
or include in the output listing.
|
|
The file descriptors are specified in the comma-separated set
|
|
<I>s</I>
|
|
|
|
- e.g., ``cwd,1,3'', ``^6,^2''.
|
|
(There should be no spaces in the set.)
|
|
<DT id="26"><DD>
|
|
The list is an exclusion list if all entries of the set begin with `^'.
|
|
It is an inclusion list if no entry begins with `^'.
|
|
Mixed lists are not permitted.
|
|
<DT id="27"><DD>
|
|
A file descriptor number range may be in the set as long as
|
|
neither member is empty, both members are numbers, and the ending
|
|
member is larger than the starting one - e.g., ``0-7'' or ``3-10''.
|
|
Ranges may be specified for exclusion if they have the `^' prefix -
|
|
e.g., ``^0-7'' excludes all file descriptors 0 through 7.
|
|
<DT id="28"><DD>
|
|
Multiple file descriptor numbers are joined in a single ORed set before
|
|
participating in AND option selection.
|
|
<DT id="29"><DD>
|
|
When there are exclusion and inclusion members in the set,
|
|
<I>lsof</I>
|
|
|
|
reports them as errors and exits with a non-zero return code.
|
|
<DT id="30"><DD>
|
|
See the description of File Descriptor (FD) output values in the
|
|
<B>OUTPUT</B>
|
|
|
|
section for more information on file descriptor names.
|
|
<DT id="31"><B>+D</B><I> D</I>
|
|
|
|
<DD>
|
|
causes
|
|
<I>lsof</I>
|
|
|
|
to search for all open instances of directory
|
|
<I>D</I>
|
|
|
|
and all the files and directories it contains to its complete depth.
|
|
<DT id="32"><DD>
|
|
Processing of the
|
|
<B>+D</B>
|
|
|
|
option does not follow symbolic links within
|
|
<I>D</I>
|
|
|
|
unless the
|
|
<B>-x</B>
|
|
|
|
or
|
|
<B>-x l</B>
|
|
|
|
option is also specified.
|
|
Nor does it
|
|
search for open files on file system mount points on subdirectories of
|
|
<I>D</I>
|
|
|
|
unless the
|
|
<B>-x</B>
|
|
|
|
or
|
|
<B>-x f</B>
|
|
|
|
option is also specified.
|
|
<DT id="33"><DD>
|
|
Note: the authority of the user of this option limits it to searching for
|
|
files that the user has permission to examine with the system
|
|
<I><A HREF="/cgi-bin/man/man2html?2+stat">stat</A></I>(2)
|
|
|
|
function.
|
|
<DT id="34"><DD>
|
|
Further note:
|
|
<I>lsof</I>
|
|
|
|
may process this option slowly and require a large amount of dynamic memory
|
|
to do it.
|
|
This is because it must descend the entire directory tree, rooted at
|
|
<I>D</I>,
|
|
|
|
calling
|
|
<I><A HREF="/cgi-bin/man/man2html?2+stat">stat</A></I>(2)
|
|
|
|
for each file and directory, building a list of all the files it finds, and
|
|
searching that list for a match with every open file.
|
|
When directory
|
|
<I>D</I>
|
|
|
|
is large, these steps can take a long time, so use this option prudently.
|
|
<DT id="35"><B>-D</B><I> D</I>
|
|
|
|
<DD>
|
|
directs
|
|
<I>lsof's</I>
|
|
|
|
use of the device cache file.
|
|
The use of this option is sometimes restricted.
|
|
See the
|
|
<B>DEVICE CACHE FILE</B>
|
|
|
|
section and the sections that follow it for more information on this
|
|
option.
|
|
<DT id="36"><DD>
|
|
<B>-D</B>
|
|
|
|
must be followed by a function letter; the function letter may optionally
|
|
be followed by a path name.
|
|
<I>Lsof</I>
|
|
|
|
recognizes these function letters:
|
|
<DT id="37"><DD>
|
|
<PRE>
|
|
<B>?</B> - report device cache file paths
|
|
<B>b</B> - build the device cache file
|
|
<B>i</B> - ignore the device cache file
|
|
<B>r</B> - read the device cache file
|
|
<B>u</B> - read and update the device cache file
|
|
</PRE>
|
|
|
|
<DT id="38"><DD>
|
|
The
|
|
<B>b</B>,
|
|
|
|
<B>r</B>,
|
|
|
|
and
|
|
<B>u</B>
|
|
|
|
functions, accompanied by a path name, are sometimes restricted.
|
|
When these functions are restricted, they will not appear in
|
|
the description of the
|
|
<B>-D</B>
|
|
|
|
option that accompanies
|
|
<B>-h</B>
|
|
|
|
or
|
|
<B>-?</B>
|
|
|
|
option output.
|
|
See the
|
|
<B>DEVICE CACHE FILE</B>
|
|
|
|
section and the sections that follow it for more information on these
|
|
functions and when they're restricted.
|
|
<DT id="39"><DD>
|
|
The
|
|
<B>?</B>
|
|
|
|
function reports the read-only and write paths that lsof can
|
|
use for the device cache file,
|
|
the names of any environment variables whose values
|
|
<I>lsof</I>
|
|
|
|
will examine when forming the device cache file path,
|
|
and the format for the personal device cache file path.
|
|
(Escape the `?' character as your shell requires.)
|
|
<DT id="40"><DD>
|
|
When available, the
|
|
<B>b</B>,
|
|
|
|
<B>r</B>,
|
|
|
|
and
|
|
<B>u</B>
|
|
|
|
functions may be followed by the device cache file's path.
|
|
The standard default is
|
|
<I>.lsof_hostname</I>
|
|
|
|
in the home directory of the real user ID that executes
|
|
<I>lsof</I>,
|
|
|
|
but this could have been changed when
|
|
<I>lsof</I>
|
|
|
|
was configured and compiled.
|
|
(The output of the
|
|
<B>-h</B>
|
|
|
|
and
|
|
<B>-?</B>
|
|
|
|
options show the current default prefix - e.g., ``.lsof''.)
|
|
The suffix,
|
|
<I>hostname</I>,
|
|
|
|
is the first component of the host's name returned by
|
|
<I><A HREF="/cgi-bin/man/man2html?2+gethostname">gethostname</A></I>(2).
|
|
|
|
<DT id="41"><DD>
|
|
When available, the
|
|
<B>b</B>
|
|
|
|
function directs
|
|
<I>lsof</I>
|
|
|
|
to build a new device cache file at the default or specified path.
|
|
<DT id="42"><DD>
|
|
The
|
|
<B>i</B>
|
|
|
|
function directs
|
|
<I>lsof</I>
|
|
|
|
to ignore the default device cache file and obtain its information
|
|
about devices via direct calls to the kernel.
|
|
<DT id="43"><DD>
|
|
The
|
|
<B>r</B>
|
|
|
|
function directs
|
|
<I>lsof</I>
|
|
|
|
to read the device cache at the default or specified path, but
|
|
prevents it from creating a new device cache file when none
|
|
exists or the existing one is improperly structured.
|
|
The
|
|
<B>r</B>
|
|
|
|
function, when specified without a path name, prevents
|
|
<I>lsof</I>
|
|
|
|
from updating an incorrect or outdated device cache file,
|
|
or creating a new one in its place.
|
|
The
|
|
<B>r</B>
|
|
|
|
function is always available when it is specified without a
|
|
path name argument; it may be restricted by the permissions of the
|
|
<I>lsof</I>
|
|
|
|
process.
|
|
<DT id="44"><DD>
|
|
When available, the
|
|
<B>u</B>
|
|
|
|
function directs
|
|
<I>lsof</I>
|
|
|
|
to read the device cache file at the default or specified path,
|
|
if possible, and to rebuild it, if necessary.
|
|
This is the default device cache file function when no
|
|
<B>-D</B>
|
|
|
|
option has been specified.
|
|
<DT id="45"><B>+|-e</B><I> s</I>
|
|
|
|
<DD>
|
|
exempts the file system whose path name is
|
|
<I>s</I>
|
|
|
|
from being subjected to kernel function calls that might block.
|
|
The
|
|
<B>+e</B>
|
|
|
|
option exempts
|
|
<I><A HREF="/cgi-bin/man/man2html?2+stat">stat</A></I>(2),
|
|
|
|
<I><A HREF="/cgi-bin/man/man2html?2+lstat">lstat</A></I>(2)
|
|
|
|
and most
|
|
<I><A HREF="/cgi-bin/man/man2html?2+readlink">readlink</A></I>(2)
|
|
|
|
kernel function calls.
|
|
The
|
|
<B>-e</B>
|
|
|
|
option exempts only
|
|
<I><A HREF="/cgi-bin/man/man2html?2+stat">stat</A>(2)</I>
|
|
|
|
and
|
|
<I><A HREF="/cgi-bin/man/man2html?2+lstat">lstat</A></I>(2)
|
|
|
|
kernel function calls.
|
|
Multiple file systems may be specified with separate
|
|
<B>+|-e</B>
|
|
|
|
specifications and each may have
|
|
<I><A HREF="/cgi-bin/man/man2html?2+readlink">readlink</A></I>(2)
|
|
|
|
calls exempted or not.
|
|
<DT id="46"><DD>
|
|
This option is currently implemented only for Linux.
|
|
<DT id="47"><DD>
|
|
<B>CAUTION:</B>
|
|
|
|
this option can easily be mis-applied to other than
|
|
the file system of interest, because it uses path name rather
|
|
than the more reliable device and inode numbers.
|
|
(Device and inode numbers are acquired via the potentially blocking
|
|
<I><A HREF="/cgi-bin/man/man2html?2+stat">stat</A></I>(2)
|
|
|
|
kernel call and are thus not available, but see the
|
|
<B>+|-m</B><I> m</I>
|
|
|
|
option as a possible alternative way to supply device numbers.)
|
|
<B>Use this option with great care and fully specify the path name of the
|
|
file system to be exempted.</B>
|
|
<DT id="48"><DD>
|
|
When open files on exempted file systems are reported, it may not be
|
|
possible to obtain all their information.
|
|
Therefore, some information columns will be blank, the characters ``UNKN''
|
|
preface the values in the TYPE column, and the applicable exemption option
|
|
is added in parentheses to the end of the NAME column.
|
|
(Some device number information might be made available via the
|
|
<B>+|-m</B><I> m</I>
|
|
|
|
option.)
|
|
<DT id="49"><B>+|-E</B>
|
|
|
|
<DD>
|
|
<B>+E</B>
|
|
|
|
specifies that Linux pipe, Linux UNIX socket and Linux pseudoterminal files
|
|
should be displayed with endpoint information and the files of the endpoints should also be displayed.
|
|
Note: UNIX socket file endpoint information is only available when the
|
|
compile flags line of
|
|
<B>-v</B>
|
|
|
|
output contains HASUXSOCKEPT, and psudoterminal endpoint information is only
|
|
available when the compile flags line contains HASPTYEPT.
|
|
<DT id="50"><DD>
|
|
Pipe endpoint information is displayed in the NAME column in the
|
|
form ``<I>PID,cmd,FDmode</I>'', where
|
|
<I>PID</I>
|
|
|
|
is the endpoint process ID;
|
|
<I>cmd</I>
|
|
|
|
is the endpoint process command;
|
|
<I>FD</I>
|
|
|
|
is the endpoint file's descriptor; and
|
|
<I>mode</I>
|
|
|
|
is the endpoint file's access mode.
|
|
<DT id="51"><DD>
|
|
Pseudoterminal
|
|
endpoint information is displayed in the NAME column as
|
|
``->/dev/pts<I>min</I> <I>PID,cmd,FDmode</I>'' or ``<I>PID,cmd,FDmode</I>''.
|
|
The first form is for a master device; the second, for a slave device.
|
|
<I>min</I>
|
|
|
|
is a slave device's minor device number; and
|
|
<I>PID, cmd, FD</I>
|
|
|
|
and
|
|
<I>mode</I>
|
|
|
|
are the same as with pipe endpoint information.
|
|
Note: psudoterminal endpoint information is only available when the compile
|
|
flags line of
|
|
<B>-V</B>
|
|
|
|
output contains HASPTYEPT.
|
|
<DT id="52"><DD>
|
|
UNIX socket file endpoint information is displayed in the NAME column
|
|
in the form
|
|
<BR>
|
|
|
|
``type=<I>TYPE</I> ->INO=<I>INODE</I> <I>PID,cmd,FDmode</I>'', where
|
|
<I>TYPE</I>
|
|
|
|
is the socket type;
|
|
<I>INODE</I>
|
|
|
|
is the i-node number of the connected socket;
|
|
and
|
|
<I>PID, cmd, FD</I>
|
|
|
|
and
|
|
<I>mode</I>
|
|
|
|
are the same as with pipe endpoint information.
|
|
Note: UNIX socket file endpoint information is available only when the
|
|
compile flags line of
|
|
<B>-v</B>
|
|
|
|
output contains HASUXSOCKEPT.
|
|
<DT id="53"><DD>
|
|
Multiple occurrences of this information can appear in a file's
|
|
NAME column.
|
|
<DT id="54"><DD>
|
|
<B>-E</B>
|
|
|
|
specfies that Linux pipe and Linux UNIX socket files should be displayed
|
|
with endpoint information, but not the files of the endpoints.
|
|
<DT id="55"><B>+|-f [cfgGn]</B>
|
|
|
|
<DD>
|
|
<B>f</B>
|
|
|
|
by itself clarifies how path name arguments are to be interpreted.
|
|
When followed by
|
|
<B>c</B>,
|
|
|
|
<B>f</B>,
|
|
|
|
<B>g</B>,
|
|
|
|
<B>G</B>,
|
|
|
|
or
|
|
<B>n</B>
|
|
|
|
in any combination it specifies
|
|
that the listing of kernel file structure information is to be enabled
|
|
(`+') or inhibited (`-').
|
|
<DT id="56"><DD>
|
|
Normally a path name argument is taken to be a file system name if
|
|
it matches a mounted-on directory name reported by
|
|
<I><A HREF="/cgi-bin/man/man2html?8+mount">mount</A></I>(8),
|
|
|
|
or if it represents a block device, named in the
|
|
<I>mount</I>
|
|
|
|
output and associated with a mounted directory name.
|
|
When
|
|
<B>+f</B>
|
|
|
|
is specified, all path name arguments will be taken to be file
|
|
system names, and
|
|
<I>lsof</I>
|
|
|
|
will complain if any are not.
|
|
This can be useful, for example, when the file system name
|
|
(mounted-on device) isn't a block device.
|
|
This happens for some CD-ROM file systems.
|
|
<DT id="57"><DD>
|
|
When
|
|
<B>-f</B>
|
|
|
|
is specified by itself, all path name arguments will be taken to be
|
|
simple files.
|
|
Thus, for example, the ``<B>-f</B> -- /'' arguments direct lsof to search
|
|
for open files with a `/' path name, not all open files in the `/'
|
|
(root) file system.
|
|
<DT id="58"><DD>
|
|
Be careful to make sure
|
|
<B>+f</B>
|
|
|
|
and
|
|
<B>-f</B>
|
|
|
|
are properly terminated and aren't followed by a character (e.g., of
|
|
the file or file system name) that might be taken as a parameter.
|
|
For example, use ``--'' after
|
|
<B>+f</B>
|
|
|
|
and
|
|
<B>-f</B>
|
|
|
|
as in these examples.
|
|
<DT id="59"><DD>
|
|
<PRE>
|
|
$ lsof +f -- /file/system/name
|
|
$ lsof -f -- /file/name
|
|
</PRE>
|
|
|
|
<DT id="60"><DD>
|
|
The listing of information from kernel file structures, requested with the
|
|
<B>+f [cfgGn]</B>
|
|
|
|
option form, is normally
|
|
inhibited, and is not available in whole or part for some dialects - e.g.,
|
|
/proc-based Linux kernels below 2.6.22.
|
|
When the prefix to
|
|
<B>f</B>
|
|
|
|
is a plus sign (`+'), these characters request file structure information:
|
|
<DT id="61"><DD>
|
|
<PRE>
|
|
<B>c</B> file structure use count (not Linux)
|
|
<B>f</B> file structure address (not Linux)
|
|
<B>g</B> file flag abbreviations (Linux 2.6.22 and up)
|
|
<B>G</B> file flags in hexadecimal (Linux 2.6.22 and up)
|
|
<B>n</B> file structure node address (not Linux)
|
|
</PRE>
|
|
|
|
<DT id="62"><DD>
|
|
When the prefix is minus (`-') the same characters disable the
|
|
listing of the indicated values.
|
|
<DT id="63"><DD>
|
|
File structure addresses, use counts, flags, and node addresses may be
|
|
used to detect more readily identical files inherited by child
|
|
processes and identical files in use by different processes.
|
|
<I>Lsof</I>
|
|
|
|
column output can be sorted by output columns holding the values
|
|
and listed to identify identical file use, or
|
|
<I>lsof</I>
|
|
|
|
field output can be parsed by an AWK or Perl post-filter script,
|
|
or by a C program.
|
|
<DT id="64"><B>-F</B><I> f</I>
|
|
|
|
<DD>
|
|
specifies a character list,
|
|
<I>f</I>,
|
|
|
|
that selects the fields to be output for processing by another program,
|
|
and the character that terminates each output field.
|
|
Each field to be output is specified with a single character in
|
|
<I>f</I>.
|
|
|
|
The field terminator defaults to NL, but may be changed to NUL (000).
|
|
See the
|
|
<B>OUTPUT FOR OTHER PROGRAMS</B>
|
|
|
|
section for a description of the field identification characters and
|
|
the field output process.
|
|
<DT id="65"><DD>
|
|
When the field selection character list is empty, all standard fields are
|
|
selected (except the raw device field, security context and zone field for
|
|
compatibility reasons)
|
|
and the NL field terminator is used.
|
|
<DT id="66"><DD>
|
|
When the field selection character list contains only a zero (`0'),
|
|
all fields are selected (except the raw device field for compatibility
|
|
reasons) and the NUL terminator character is used.
|
|
<DT id="67"><DD>
|
|
Other combinations of fields and their associated field terminator
|
|
character must be set with explicit entries in
|
|
<I>f</I>,
|
|
|
|
as described in the
|
|
<B>OUTPUT FOR OTHER PROGRAMS</B>
|
|
|
|
section.
|
|
<DT id="68"><DD>
|
|
When a field selection character identifies an item
|
|
<I>lsof</I>
|
|
|
|
does not normally list - e.g., PPID, selected with
|
|
<B>-R</B> -
|
|
|
|
specification of the field character - e.g., ``<B>-FR</B>'' -
|
|
also selects the listing of the item.
|
|
<DT id="69"><DD>
|
|
When the field selection character list contains the single
|
|
character `?',
|
|
<I>lsof</I>
|
|
|
|
will display a help list of the field identification characters.
|
|
(Escape the `?' character as your shell requires.)
|
|
<DT id="70"><B>-g</B><I> [s]</I>
|
|
|
|
<DD>
|
|
excludes or selects the listing of files for the processes
|
|
whose optional process group IDentification (PGID) numbers are in the
|
|
comma-separated set
|
|
<I>s</I>
|
|
|
|
- e.g., ``123'' or ``123,^456''.
|
|
(There should be no spaces in the set.)
|
|
<DT id="71"><DD>
|
|
PGID numbers that begin with `^' (negation) represent exclusions.
|
|
<DT id="72"><DD>
|
|
Multiple PGID numbers are joined in a single ORed set before participating
|
|
in AND option selection.
|
|
However, PGID exclusions are applied without ORing or ANDing
|
|
and take effect before other selection criteria are applied.
|
|
<DT id="73"><DD>
|
|
The
|
|
<B>-g</B>
|
|
|
|
option also enables the output display of PGID numbers.
|
|
When specified without a PGID set that's all it does.
|
|
<DT id="74"><B>-i</B><I> [i]</I>
|
|
|
|
<DD>
|
|
selects the listing of files any of whose Internet address
|
|
matches the address specified in <I>i</I>.
|
|
If no address is specified, this option selects the listing of all
|
|
Internet and x.25 (HP-UX) network files.
|
|
<DT id="75"><DD>
|
|
If
|
|
<B>-i</B><I>4</I>
|
|
|
|
or
|
|
<B>-i</B><I>6</I>
|
|
|
|
is specified with no following address, only files of the indicated
|
|
IP version, IPv4 or IPv6, are displayed.
|
|
(An IPv6 specification may be used only if the dialects supports IPv6,
|
|
as indicated by ``[46]'' and ``IPv[46]'' in
|
|
<I>lsof's</I>
|
|
|
|
<B>-h</B>
|
|
|
|
or
|
|
<B>-?</B>
|
|
|
|
output.)
|
|
Sequentially specifying
|
|
<B>-i</B>4,
|
|
|
|
followed by
|
|
<B>-i</B>6
|
|
|
|
is the same as specifying
|
|
<B>-i</B>,
|
|
|
|
and vice-versa.
|
|
Specifying
|
|
<B>-i</B>4,
|
|
|
|
or
|
|
<B>-i</B>6
|
|
|
|
after
|
|
<B>-i</B>
|
|
|
|
is the same as specifying
|
|
<B>-i</B>4
|
|
|
|
or
|
|
<B>-i</B>6
|
|
|
|
by itself.
|
|
<DT id="76"><DD>
|
|
Multiple addresses (up to a limit of 100) may be specified with multiple
|
|
<B>-i</B>
|
|
|
|
options.
|
|
(A port number or service name range is counted as one address.)
|
|
They are joined in a single ORed set before participating in
|
|
AND option selection.
|
|
<DT id="77"><DD>
|
|
An Internet address is specified in the form (Items in square
|
|
brackets are optional.):
|
|
<DT id="78"><DD>
|
|
|
|
[<I>46</I>][<I>protocol</I>][@<I>hostname</I>|<I>hostaddr</I>][:<I>service</I>|<I>port</I>]
|
|
|
|
|
|
<DT id="79"><DD>
|
|
where:
|
|
<PRE>
|
|
<BR>
|
|
<I>46</I> specifies the IP version, IPv4 or IPv6
|
|
<BR>
|
|
that applies to the following address.
|
|
<BR>
|
|
'6' may be be specified only if the UNIX
|
|
<BR>
|
|
dialect supports IPv6. If neither '4' nor
|
|
<BR>
|
|
'6' is specified, the following address
|
|
<BR>
|
|
applies to all IP versions.
|
|
<BR>
|
|
<I>protocol</I> is a protocol name - <B>TCP</B>, <B>UDP</B>
|
|
<BR>
|
|
<BR>
|
|
<I>hostname</I> is an Internet host name. Unless a
|
|
<BR>
|
|
specific IP version is specified, open
|
|
<BR>
|
|
network files associated with host names
|
|
<BR>
|
|
of all versions will be selected.
|
|
<BR>
|
|
<I>hostaddr</I> is a numeric Internet IPv4 address in
|
|
<BR>
|
|
dot form; or an IPv6 numeric address in
|
|
<BR>
|
|
colon form, enclosed in brackets, if the
|
|
<BR>
|
|
UNIX dialect supports IPv6. When an IP
|
|
<BR>
|
|
version is selected, only its numeric
|
|
<BR>
|
|
addresses may be specified.
|
|
<BR>
|
|
<I>service</I> is an <I>/etc/services</I> name - e.g., <B>smtp</B> -
|
|
or a list of them.
|
|
<BR>
|
|
<I>port</I> is a port number, or a list of them.
|
|
</PRE>
|
|
|
|
<DT id="80"><DD>
|
|
IPv6 options may be used only if the UNIX dialect supports IPv6.
|
|
To see if the dialect supports IPv6, run
|
|
<I>lsof</I>
|
|
|
|
and specify the
|
|
<B>-h</B>
|
|
|
|
or
|
|
<B>-?</B>
|
|
|
|
(help) option.
|
|
If the displayed description of the
|
|
<B>-i</B>
|
|
|
|
option contains ``[46]'' and ``IPv[46]'', IPv6 is supported.
|
|
<DT id="81"><DD>
|
|
IPv4 host names and addresses may not be specified if network file selection
|
|
is limited to IPv6 with
|
|
<B>-i</B> 6.
|
|
|
|
IPv6 host names and addresses may not be specified if network file selection
|
|
is limited to IPv4 with
|
|
<B>-i</B> 4.
|
|
|
|
When an open IPv4 network file's address is mapped in an IPv6 address,
|
|
the open file's type will be IPv6, not IPv4, and its display will be
|
|
selected by '6', not '4'.
|
|
<DT id="82"><DD>
|
|
At least one address component -
|
|
<B>4,</B>
|
|
|
|
<B>6,</B>
|
|
|
|
<I>protocol</I>,
|
|
|
|
<I>hostname</I>,
|
|
|
|
<I>hostaddr</I>,
|
|
|
|
or
|
|
<I>service</I>
|
|
|
|
- must be supplied.
|
|
The `@' character, leading the host specification, is always required;
|
|
as is the `:', leading the port specification.
|
|
Specify either
|
|
<I>hostname</I>
|
|
|
|
or
|
|
<I>hostaddr</I>.
|
|
|
|
Specify either
|
|
<I>service</I>
|
|
|
|
name list or
|
|
<I>port</I>
|
|
|
|
number list.
|
|
If a
|
|
<I>service</I>
|
|
|
|
name list is specified, the
|
|
<I>protocol</I>
|
|
|
|
may also need to be specified if the TCP, UDP and UDPLITE port numbers for
|
|
the service name are different.
|
|
Use any case - lower or upper - for
|
|
<I>protocol</I>.
|
|
|
|
<DT id="83"><DD>
|
|
<I>Service</I>
|
|
|
|
names and
|
|
<I>port</I>
|
|
|
|
numbers may be combined in a list whose entries are separated by commas
|
|
and whose numeric range entries are separated by minus signs.
|
|
There may be no embedded spaces, and all service names must belong to
|
|
the specified
|
|
<I>protocol</I>.
|
|
|
|
Since service names may contain embedded minus signs, the starting entry
|
|
of a range can't be a service name; it can be a port number, however.
|
|
<DT id="84"><DD>
|
|
Here are some sample addresses:
|
|
<PRE>
|
|
|
|
<BR>
|
|
-i6 - IPv6 only
|
|
<BR>
|
|
TCP:25 - TCP and port 25
|
|
<BR>
|
|
@1.2.3.4 - Internet IPv4 host address 1.2.3.4
|
|
<BR>
|
|
@[3ffe:1ebc::1]:1234 - Internet IPv6 host address
|
|
3ffe:1ebc::1, port 1234
|
|
<BR>
|
|
UDP:who - UDP who service port
|
|
<BR>
|
|
<A HREF="mailto:TCP@lsof.itap">TCP@lsof.itap</A>:513 - TCP, port 513 and host name lsof.itap
|
|
<BR>
|
|
tcp@foo:1-10,smtp,99 - TCP, ports 1 through 10,
|
|
service name <I>smtp</I>, port 99, host name foo
|
|
<BR>
|
|
tcp@bar:1-smtp - TCP, ports 1 through <I>smtp</I>, host bar
|
|
<BR>
|
|
:time - either TCP, UDP or UDPLITE time service port
|
|
</PRE>
|
|
|
|
<DT id="85"><B>-K</B><I> k</I>
|
|
|
|
<DD>
|
|
selects the listing of tasks (threads) of processes, on dialects
|
|
where task (thread) reporting is supported.
|
|
(If help output - i.e., the output of the
|
|
<B>-h</B>
|
|
|
|
or
|
|
<B>-?</B>
|
|
|
|
options - shows this option, then task (thread) reporting is
|
|
supported by the dialect.)
|
|
<DT id="86"><DD>
|
|
If
|
|
<B>-K</B>
|
|
|
|
is followed by a value,
|
|
<I>k</I>,
|
|
|
|
it must be ``i''. That causes
|
|
<I>lsof</I>
|
|
|
|
to ignore tasks, particularly in the default, list-everything case
|
|
when no other options are specified.
|
|
<DT id="87"><DD>
|
|
When
|
|
<B>-K</B>
|
|
|
|
and
|
|
<B>-a</B>
|
|
|
|
are both specified on Linux, and the tasks of a main process are
|
|
selected by other options, the main process will also be listed
|
|
as though it were a task, but without a task ID.
|
|
(See the description of the TID column in the
|
|
<B>OUTPUT</B>
|
|
|
|
section.)
|
|
<DT id="88"><DD>
|
|
Where the FreeBSD version supports threads, all threads will be
|
|
listed with their IDs.
|
|
<DT id="89"><DD>
|
|
In general threads and tasks inherit the files of the caller, but
|
|
may close some and open others, so
|
|
<I>lsof</I>
|
|
|
|
always reports all the open files of threads and tasks.
|
|
<DT id="90"><B>-k</B><I> k</I>
|
|
|
|
<DD>
|
|
specifies a kernel name list file,
|
|
<I>k</I>,
|
|
|
|
in place of /vmunix, /mach, etc.
|
|
<B>-k</B>
|
|
|
|
is not available under AIX on the IBM RISC/System 6000.
|
|
<DT id="91"><B>-l</B>
|
|
|
|
<DD>
|
|
inhibits the conversion of user ID numbers to login names.
|
|
It is also useful when login name lookup is working improperly or slowly.
|
|
<DT id="92"><B>+|-L</B><I> [l]</I>
|
|
|
|
<DD>
|
|
enables (`+') or disables (`-') the listing of file link
|
|
counts, where they are available - e.g., they aren't available
|
|
for sockets, or most FIFOs and pipes.
|
|
<DT id="93"><DD>
|
|
When
|
|
<B>+L</B>
|
|
|
|
is specified without a following number, all link counts will be listed.
|
|
When
|
|
<B>-L</B>
|
|
|
|
is specified (the default), no link counts will be listed.
|
|
<DT id="94"><DD>
|
|
When
|
|
<B>+L</B>
|
|
|
|
is followed by a number, only files having a link count less than
|
|
that number will be listed.
|
|
(No number may follow
|
|
<B>-L</B>.)
|
|
|
|
A specification of the form ``<B>+L1</B>'' will select open files that
|
|
have been unlinked.
|
|
A specification of the form ``<B>+aL1 </B><I><file_system></I>'' will select
|
|
unlinked open files on the specified file system.
|
|
<DT id="95"><DD>
|
|
For other link count comparisons, use field output (<B>-F</B>)
|
|
and a post-processing script or program.
|
|
<DT id="96"><B>+|-m</B><I> m</I>
|
|
|
|
<DD>
|
|
specifies an alternate kernel memory file or activates
|
|
mount table supplement processing.
|
|
<DT id="97"><DD>
|
|
The option form
|
|
<B>-m</B><I> m</I>
|
|
|
|
specifies a kernel memory file,
|
|
<I>m</I>,
|
|
|
|
in place of
|
|
<I>/dev/kmem</I>
|
|
|
|
or
|
|
<I>/dev/mem</I>
|
|
|
|
- e.g., a crash dump file.
|
|
<DT id="98"><DD>
|
|
The option form
|
|
<B>+m</B>
|
|
|
|
requests that a mount supplement file be written to the standard output
|
|
file.
|
|
All other options are silently ignored.
|
|
<DT id="99"><DD>
|
|
There will be a line in the mount supplement file for each mounted file
|
|
system, containing the mounted file system directory, followed by a single
|
|
space, followed by the device number in hexadecimal "0x" format - e.g.,
|
|
<DT id="100"><DD>
|
|
<PRE>
|
|
/ 0x801
|
|
</PRE>
|
|
|
|
<DT id="101"><DD>
|
|
<I>Lsof</I>
|
|
|
|
can use the mount supplement file to get device numbers for file systems
|
|
when it can't get them via
|
|
<I><A HREF="/cgi-bin/man/man2html?2+stat">stat</A></I>(2)
|
|
|
|
or
|
|
<I><A HREF="/cgi-bin/man/man2html?2+lstat">lstat</A></I>(2).
|
|
|
|
<DT id="102"><DD>
|
|
The option form
|
|
<B>+m</B><I> m</I>
|
|
|
|
identifies
|
|
<I>m</I>
|
|
|
|
as a mount supplement file.
|
|
<DT id="103"><DD>
|
|
Note: the
|
|
<B>+m</B>
|
|
|
|
and
|
|
<B>+m</B><I> m</I>
|
|
|
|
options are not available for all supported dialects.
|
|
Check the output of
|
|
<I>lsof's</I>
|
|
|
|
<B>-h</B>
|
|
|
|
or
|
|
<B>-?</B>
|
|
|
|
options to see if the
|
|
<B>+m</B>
|
|
|
|
and
|
|
<B>+m</B><I> m</I>
|
|
|
|
options are available.
|
|
<DT id="104"><B>+|-M</B>
|
|
|
|
<DD>
|
|
Enables (<B>+</B>) or disables (<B>-</B>) the
|
|
reporting of portmapper registrations for local TCP, UDP and UDPLITE ports,
|
|
where port mapping is supported.
|
|
(See the last paragraph of this option description for information about
|
|
where portmapper registration reporting is supported.)
|
|
<DT id="105"><DD>
|
|
The default reporting mode is set by the
|
|
<I>lsof</I>
|
|
|
|
builder with the HASPMAPENABLED #define in the dialect's machine.h
|
|
header file;
|
|
<I>lsof</I>
|
|
|
|
is distributed with the HASPMAPENABLED #define deactivated, so
|
|
portmapper reporting is disabled by default and must be requested
|
|
with
|
|
<B>+M</B>.
|
|
|
|
Specifying
|
|
<I>lsof's</I>
|
|
|
|
<B>-h</B>
|
|
|
|
or
|
|
<B>-?</B>
|
|
|
|
option will report the default mode.
|
|
Disabling portmapper registration when it is already disabled or
|
|
enabling it when already enabled is acceptable.
|
|
When portmapper registration reporting is enabled,
|
|
<I>lsof</I>
|
|
|
|
displays the portmapper registration (if any) for local TCP, UDP or
|
|
UDPLITE ports
|
|
in square brackets immediately following the port numbers or service
|
|
names - e.g., ``:1234[name]'' or ``:name[100083]''.
|
|
The registration information may be a name or number, depending
|
|
on what the registering program supplied to the portmapper when
|
|
it registered the port.
|
|
<DT id="106"><DD>
|
|
When portmapper registration reporting is enabled,
|
|
<I>lsof</I>
|
|
|
|
may run a little more slowly or even become blocked when access to the
|
|
portmapper becomes congested or stopped.
|
|
Reverse the reporting mode to determine if portmapper registration
|
|
reporting is slowing or blocking
|
|
<I>lsof</I>.
|
|
|
|
<DT id="107"><DD>
|
|
For purposes of portmapper registration reporting
|
|
<I>lsof</I>
|
|
|
|
considers a TCP, UDP or UDPLITE port local if: it is found in the local part
|
|
of its containing kernel structure;
|
|
or if it is located in the foreign part of its containing kernel
|
|
structure and the local and foreign Internet addresses are the same;
|
|
or if it is located in the foreign part of its containing kernel
|
|
structure and the foreign Internet address is INADDR_LOOPBACK (127.0.0.1).
|
|
This rule may make
|
|
<I>lsof</I>
|
|
|
|
ignore some foreign ports on machines with multiple interfaces
|
|
when the foreign Internet address is on a different interface
|
|
from the local one.
|
|
<DT id="108"><DD>
|
|
See the
|
|
<I>lsof</I>
|
|
|
|
FAQ (The <B>FAQ</B> section gives its location.)
|
|
for further discussion of portmapper registration
|
|
reporting issues.
|
|
<DT id="109"><DD>
|
|
Portmapper registration reporting is supported only on dialects that
|
|
have RPC header files.
|
|
(Some Linux distributions with GlibC 2.14 do not have them.)
|
|
When portmapper registration reporting is supported, the
|
|
<B>-h</B>
|
|
|
|
or
|
|
<B>-?</B>
|
|
|
|
help output will show the
|
|
<B>+|-M</B>
|
|
|
|
option.
|
|
<DT id="110"><B>-n</B>
|
|
|
|
<DD>
|
|
inhibits the conversion of network numbers to
|
|
host names for network files.
|
|
Inhibiting conversion may make
|
|
<I>lsof</I>
|
|
|
|
run faster.
|
|
It is also useful when host name lookup is not working properly.
|
|
<DT id="111"><B>-N</B>
|
|
|
|
<DD>
|
|
selects the listing of NFS files.
|
|
<DT id="112"><B>-o</B>
|
|
|
|
<DD>
|
|
directs
|
|
<I>lsof</I>
|
|
|
|
to display file offset at all times.
|
|
It causes the SIZE/OFF output column title to be changed to OFFSET.
|
|
Note: on some UNIX dialects
|
|
<I>lsof</I>
|
|
|
|
can't obtain accurate or consistent file offset information from its
|
|
kernel data sources, sometimes just for particular kinds of files
|
|
(e.g., socket files.)
|
|
Consult the
|
|
<I>lsof</I>
|
|
|
|
FAQ (The <B>FAQ</B> section gives its location.)
|
|
for more information.
|
|
<DT id="113"><DD>
|
|
The
|
|
<B>-o</B>
|
|
|
|
and
|
|
<B>-s</B>
|
|
|
|
options are mutually exclusive; they can't both be specified.
|
|
When neither is specified,
|
|
<I>lsof</I>
|
|
|
|
displays whatever value - size or offset - is appropriate and
|
|
available for the type of the file.
|
|
<DT id="114"><B>-o</B><I> o</I>
|
|
|
|
<DD>
|
|
defines the number of decimal digits (<I>o</I>) to be
|
|
printed after the ``0t'' for a file offset before the form is switched
|
|
to ``0x...''.
|
|
An
|
|
<I>o</I>
|
|
|
|
value of zero (unlimited) directs
|
|
<I>lsof</I>
|
|
|
|
to use the ``0t'' form for all offset output.
|
|
<DT id="115"><DD>
|
|
This option does NOT direct
|
|
<I>lsof</I>
|
|
|
|
to display offset at all times; specify
|
|
<B>-o</B>
|
|
|
|
(without a trailing number) to do that.
|
|
<B>-o</B><I> o</I>
|
|
|
|
only specifies the number of digits after ``0t'' in
|
|
either mixed size and offset or offset-only output.
|
|
Thus, for example, to direct
|
|
<I>lsof</I>
|
|
|
|
to display offset at all times with a decimal digit count of 10, use:
|
|
<DT id="116"><DD>
|
|
<PRE>
|
|
-o -o 10
|
|
or
|
|
-oo10
|
|
</PRE>
|
|
|
|
<DT id="117"><DD>
|
|
The default number of digits allowed after ``0t'' is normally 8,
|
|
but may have been changed by the lsof builder.
|
|
Consult the description of the
|
|
<B>-o</B><I> o</I>
|
|
|
|
option in the output of the
|
|
<B>-h</B>
|
|
|
|
or
|
|
<B>-?</B>
|
|
|
|
option to determine the default that is in effect.
|
|
<DT id="118"><B>-O</B>
|
|
|
|
<DD>
|
|
directs
|
|
<I>lsof</I>
|
|
|
|
to bypass the strategy it uses to avoid being blocked by some
|
|
kernel operations - i.e., doing them in forked child processes.
|
|
See the
|
|
<B>BLOCKS AND TIMEOUTS</B>
|
|
|
|
and
|
|
<B>AVOIDING KERNEL BLOCKS</B>
|
|
|
|
sections for more information on kernel operations that may block
|
|
<I>lsof</I>.
|
|
|
|
<DT id="119"><DD>
|
|
While use of this option will reduce
|
|
<I>lsof</I>
|
|
|
|
startup overhead, it may also cause
|
|
<I>lsof</I>
|
|
|
|
to hang when the kernel doesn't respond to a function.
|
|
Use this option cautiously.
|
|
<DT id="120"><B>-p</B><I> s</I>
|
|
|
|
<DD>
|
|
excludes or selects the listing of files for the processes
|
|
whose optional process IDentification (PID) numbers are in the
|
|
comma-separated set
|
|
<I>s</I>
|
|
|
|
- e.g., ``123'' or ``123,^456''.
|
|
(There should be no spaces in the set.)
|
|
<DT id="121"><DD>
|
|
PID numbers that begin with `^' (negation) represent exclusions.
|
|
<DT id="122"><DD>
|
|
Multiple process ID numbers are joined in a single ORed set before
|
|
participating in AND option selection.
|
|
However, PID exclusions are applied without ORing or ANDing
|
|
and take effect before other selection criteria are applied.
|
|
<DT id="123"><B>-P</B>
|
|
|
|
<DD>
|
|
inhibits the conversion of port numbers to port
|
|
names for network files.
|
|
Inhibiting the conversion may make
|
|
<I>lsof</I>
|
|
|
|
run a little faster.
|
|
It is also useful when port name lookup is not working properly.
|
|
<DT id="124"><B>+|-r</B><I> [t[m<fmt>]]</I>
|
|
|
|
<DD>
|
|
puts
|
|
<I>lsof</I>
|
|
|
|
in repeat mode.
|
|
There
|
|
<I>lsof</I>
|
|
|
|
lists open files as selected by other options, delays
|
|
<I>t</I>
|
|
|
|
seconds (default fifteen), then repeats the listing, delaying
|
|
and listing repetitively until stopped by a condition defined by
|
|
the prefix to the option.
|
|
<DT id="125"><DD>
|
|
If the prefix is a `-', repeat mode is endless.
|
|
<I>Lsof</I>
|
|
|
|
must be terminated with an interrupt or quit signal.
|
|
<DT id="126"><DD>
|
|
If the prefix is `+', repeat mode will end the first cycle no open files
|
|
are listed - and of course when
|
|
<I>lsof</I>
|
|
|
|
is stopped with an interrupt or quit signal.
|
|
When repeat mode ends because no files are listed, the process exit code
|
|
will be zero if any open files were ever listed; one, if none were ever
|
|
listed.
|
|
<DT id="127"><DD>
|
|
<I>Lsof</I>
|
|
|
|
marks the end of each listing:
|
|
if field output is in progress (the
|
|
<B>-F</B>,
|
|
|
|
option has been specified), the default marker is `m'; otherwise the
|
|
default marker is ``========''.
|
|
The marker is followed by a NL character.
|
|
<DT id="128"><DD>
|
|
The optional "m<fmt>" argument specifies a format for the marker line.
|
|
The <fmt> characters following `m' are interpreted as a format
|
|
specification to the
|
|
<I><A HREF="/cgi-bin/man/man2html?3+strftime">strftime</A></I>(3)
|
|
|
|
function, when both it and the
|
|
<I><A HREF="/cgi-bin/man/man2html?3+localtime">localtime</A></I>(3)
|
|
|
|
function are available in the dialect's C library.
|
|
Consult the
|
|
<I><A HREF="/cgi-bin/man/man2html?3+strftime">strftime</A></I>(3)
|
|
|
|
documentation for what may appear in its format specification.
|
|
Note that when field output is requested with the
|
|
<B>-F</B>
|
|
|
|
option, <fmt> cannot contain the NL format, ``%n''.
|
|
Note also that when <fmt> contains spaces or other characters that
|
|
affect the shell's interpretation of arguments, <fmt> must be
|
|
quoted appropriately.
|
|
<DT id="129"><DD>
|
|
Repeat mode reduces
|
|
<I>lsof</I>
|
|
|
|
startup overhead, so it is more efficient to use this mode
|
|
than to call
|
|
<I>lsof</I>
|
|
|
|
repetitively from a shell script, for example.
|
|
<DT id="130"><DD>
|
|
To use repeat mode most efficiently, accompany
|
|
<B>+|-r</B>
|
|
|
|
with specification of other
|
|
<I>lsof</I>
|
|
|
|
selection options, so the amount of kernel memory access
|
|
<I>lsof</I>
|
|
|
|
does will be kept to a minimum.
|
|
Options that filter at the process level - e.g.,
|
|
<B>-c</B>,
|
|
|
|
<B>-g</B>,
|
|
|
|
<B>-p</B>,
|
|
|
|
<B>-u</B>
|
|
|
|
- are the most efficient selectors.
|
|
<DT id="131"><DD>
|
|
Repeat mode is useful when coupled with field output (see the
|
|
<B>-F</B>,
|
|
|
|
option description) and a supervising
|
|
<I>awk</I>
|
|
|
|
or
|
|
<I>Perl</I>
|
|
|
|
script, or a C program.
|
|
<DT id="132"><B>-R</B>
|
|
|
|
<DD>
|
|
directs lsof to list the Parent Process IDentification
|
|
number in the PPID column.
|
|
<DT id="133"><B>-s</B><I> [p:s]</I>
|
|
|
|
<DD>
|
|
<B>s</B>
|
|
|
|
alone directs
|
|
<I>lsof</I>
|
|
|
|
to display file size at all times.
|
|
It causes the SIZE/OFF output column title to be changed to SIZE.
|
|
If the file does not have a size, nothing is displayed.
|
|
<DT id="134"><DD>
|
|
The optional
|
|
<B>-s</B><I> p:s</I>
|
|
|
|
form is available only for selected dialects, and only when the
|
|
<B>-h</B>
|
|
|
|
or
|
|
<B>-?</B>
|
|
|
|
help output lists it.
|
|
<DT id="135"><DD>
|
|
When the optional form is available, the
|
|
<B>s</B>
|
|
|
|
may be followed by a protocol name (<I>p</I>), either TCP or UDP,
|
|
a colon (`:') and a comma-separated protocol state name list,
|
|
the option causes open TCP and UDP files to be excluded if their
|
|
state name(s) are in the list (<I>s</I>) preceded by a `^'; or
|
|
included if their name(s) are not preceded by a `^'.
|
|
<DT id="136"><DD>
|
|
Dialects that support this option may support only one protocol.
|
|
When an unsupported protocol is specified, a message will be
|
|
displayed indicating state names for the protocol are unavailable.
|
|
<DT id="137"><DD>
|
|
When an inclusion list is defined, only network files with state
|
|
names in the list will be present in the
|
|
<I>lsof</I>
|
|
|
|
output.
|
|
Thus, specifying one state name means that only network files
|
|
with that lone state name will be listed.
|
|
<DT id="138"><DD>
|
|
Case is unimportant in the protocol or state names, but there may
|
|
be no spaces and the colon (`:') separating the protocol
|
|
name (<I>p</I>) and the state name list (<I>s</I>) is required.
|
|
<DT id="139"><DD>
|
|
If only TCP and UDP files are to be listed, as controlled by
|
|
the specified exclusions and inclusions, the
|
|
<B>-i</B>
|
|
|
|
option must be specified, too.
|
|
If only a single protocol's files are to be listed, add its name
|
|
as an argument to the
|
|
<B>-i</B>
|
|
|
|
option.
|
|
<DT id="140"><DD>
|
|
For example, to list only network files with TCP state LISTEN, use:
|
|
<DT id="141"><DD>
|
|
<PRE>
|
|
-iTCP -sTCP:LISTEN
|
|
</PRE>
|
|
|
|
<DT id="142"><DD>
|
|
Or, for example, to list network files with all UDP states except
|
|
Idle, use:
|
|
<DT id="143"><DD>
|
|
<PRE>
|
|
-iUDP -sUDP:^Idle
|
|
</PRE>
|
|
|
|
<DT id="144"><DD>
|
|
State names vary with UNIX dialects, so it's not possible to
|
|
provide a complete list. Some common TCP state names are:
|
|
CLOSED, IDLE, BOUND, LISTEN, ESTABLISHED, SYN_SENT, SYN_RCDV,
|
|
ESTABLISHED, CLOSE_WAIT, FIN_WAIT1, CLOSING, LAST_ACK, FIN_WAIT_2,
|
|
and TIME_WAIT.
|
|
Two common UDP state names are Unbound and Idle.
|
|
<DT id="145"><DD>
|
|
See the
|
|
<I>lsof</I>
|
|
|
|
FAQ (The <B>FAQ</B> section gives its location.)
|
|
for more information on how to use protocol state exclusion and
|
|
inclusion, including examples.
|
|
<DT id="146"><DD>
|
|
The
|
|
<B>-o</B>
|
|
|
|
(without a following decimal digit count) and
|
|
<B>-s</B>
|
|
|
|
option (without a following protocol and state name list)
|
|
are mutually exclusive; they can't both be specified.
|
|
When neither is specified,
|
|
<I>lsof</I>
|
|
|
|
displays whatever value - size or offset - is appropriate and
|
|
available for the type of file.
|
|
<DT id="147"><DD>
|
|
Since some types of files don't have true sizes - sockets, FIFOs,
|
|
pipes, etc. - lsof displays for their sizes the content amounts in
|
|
their associated kernel buffers, if possible.
|
|
<DT id="148"><B>-S</B><I> [t]</I>
|
|
|
|
<DD>
|
|
specifies an optional time-out seconds value for kernel functions -
|
|
<I><A HREF="/cgi-bin/man/man2html?2+lstat">lstat</A></I>(2),
|
|
|
|
<I><A HREF="/cgi-bin/man/man2html?2+readlink">readlink</A></I>(2),
|
|
|
|
and
|
|
<I><A HREF="/cgi-bin/man/man2html?2+stat">stat</A></I>(2)
|
|
|
|
- that might otherwise deadlock.
|
|
The minimum for
|
|
<I>t</I>
|
|
|
|
is two;
|
|
the default, fifteen; when no value is specified, the default is used.
|
|
<DT id="149"><DD>
|
|
See the
|
|
<B>BLOCKS AND TIMEOUTS</B>
|
|
|
|
section for more information.
|
|
<DT id="150"><B>-T</B><I> [t]</I>
|
|
|
|
<DD>
|
|
controls the reporting of some TCP/TPI information, also
|
|
reported by
|
|
<I><A HREF="/cgi-bin/man/man2html?1+netstat">netstat</A></I>(1),
|
|
|
|
following the network addresses.
|
|
In normal output the information appears in parentheses, each item
|
|
except TCP or TPI state name identified by a keyword, followed by `=',
|
|
separated from others by a single space:
|
|
<DT id="151"><DD>
|
|
<PRE>
|
|
<TCP or TPI state name>
|
|
QR=<read queue length>
|
|
QS=<send queue length>
|
|
SO=<socket options and values>
|
|
SS=<socket states>
|
|
TF=<TCP flags and values>
|
|
WR=<window read length>
|
|
WW=<window write length>
|
|
</PRE>
|
|
|
|
<DT id="152"><DD>
|
|
Not all values are reported for all UNIX dialects.
|
|
Items values (when available) are reported after the item name and '='.
|
|
<DT id="153"><DD>
|
|
When the field output mode is in effect (See
|
|
<B>OUTPUT FOR OTHER PROGRAMS</B>.)
|
|
|
|
each item appears as a field with a `T' leading character.
|
|
<DT id="154"><DD>
|
|
<B>-T</B>
|
|
|
|
with no following key characters disables TCP/TPI information reporting.
|
|
<DT id="155"><DD>
|
|
<B>-T</B>
|
|
|
|
with following characters selects the reporting of specific TCP/TPI
|
|
information:
|
|
<DT id="156"><DD>
|
|
<PRE>
|
|
<B>f</B> selects reporting of socket options,
|
|
states and values, and TCP flags and
|
|
values.
|
|
<B>q</B> selects queue length reporting.
|
|
<B>s</B> selects connection state reporting.
|
|
<B>w</B> selects window size reporting.
|
|
</PRE>
|
|
|
|
<DT id="157"><DD>
|
|
Not all selections are enabled for some UNIX dialects.
|
|
State may be selected for all dialects and is reported by default.
|
|
The
|
|
<B>-h</B>
|
|
|
|
or
|
|
<B>-?</B>
|
|
|
|
help output for the
|
|
<B>-T</B>
|
|
|
|
option will show what selections may be used with the UNIX dialect.
|
|
<DT id="158"><DD>
|
|
When
|
|
<B>-T</B>
|
|
|
|
is used to select information - i.e., it is followed by one or more
|
|
selection characters - the displaying of state is disabled by default,
|
|
and it must be explicitly selected again in the characters following
|
|
<B>-T</B>.
|
|
|
|
(In effect, then, the default is equivalent to
|
|
<B>-Ts</B>.)
|
|
|
|
For example, if queue lengths and state are desired, use
|
|
<B>-Tqs</B>.
|
|
|
|
<DT id="159"><DD>
|
|
Socket options, socket states, some socket values, TCP flags and
|
|
one TCP value may be reported (when available in the UNIX dialect)
|
|
in the form of the names that commonly appear after SO_, so_, SS_,
|
|
TCP_ and TF_ in the dialect's header files -
|
|
most often <<A HREF="file:///usr/include/sys/socket.h">sys/socket.h</A>>, <<A HREF="file:///usr/include/sys/socketvar.h">sys/socketvar.h</A>> and <<A HREF="file:///usr/include/netinet/tcp_var.h">netinet/tcp_var.h</A>>.
|
|
Consult those header files for the meaning of the flags, options,
|
|
states and values.
|
|
<DT id="160"><DD>
|
|
``SO='' precedes socket options and values; ``SS='', socket states;
|
|
and ``TF='', TCP flags and values.
|
|
<DT id="161"><DD>
|
|
If a flag or option has a value, the value will follow an '=' and
|
|
the name -- e.g., ``SO=LINGER=5'', ``SO=QLIM=5'', ``TF=MSS=512''.
|
|
The following seven values may be reported:
|
|
<DT id="162"><DD>
|
|
<PRE>
|
|
Name
|
|
Reported Description (Common Symbol)
|
|
|
|
KEEPALIVE keep alive time (SO_KEEPALIVE)
|
|
LINGER linger time (SO_LINGER)
|
|
MSS maximum segment size (TCP_MAXSEG)
|
|
PQLEN partial listen queue connections
|
|
QLEN established listen queue connections
|
|
QLIM established listen queue limit
|
|
RCVBUF receive buffer length (SO_RCVBUF)
|
|
SNDBUF send buffer length (SO_SNDBUF)
|
|
</PRE>
|
|
|
|
<DT id="163"><DD>
|
|
Details on what socket options and values, socket states, and TCP flags
|
|
and values may be displayed for particular UNIX dialects may be found in
|
|
the answer to the ``Why doesn't lsof report socket options, socket states,
|
|
and TCP flags and values for my dialect?'' and ``Why doesn't lsof report
|
|
the partial listen queue connection count for my dialect?''
|
|
questions in the
|
|
<I>lsof</I>
|
|
|
|
FAQ (The <B>FAQ</B> section gives its location.)
|
|
<DT id="164"><B>-t</B>
|
|
|
|
<DD>
|
|
specifies that
|
|
<I>lsof</I>
|
|
|
|
should produce terse output with process identifiers only and no header -
|
|
e.g., so that the output may be piped to
|
|
<I><A HREF="/cgi-bin/man/man2html?1+kill">kill</A></I>(1).
|
|
|
|
<B>-t</B>
|
|
|
|
selects the
|
|
<B>-w</B>
|
|
|
|
option.
|
|
<DT id="165"><B>-u</B><I> s</I>
|
|
|
|
<DD>
|
|
selects the listing of files for the user whose login names
|
|
or user ID numbers are in the comma-separated set
|
|
<I>s</I>
|
|
|
|
- e.g., ``abe'',
|
|
or ``548,root''.
|
|
(There should be no spaces in the set.)
|
|
<DT id="166"><DD>
|
|
Multiple login names or user ID numbers are joined in a single ORed set
|
|
before participating in AND option selection.
|
|
<DT id="167"><DD>
|
|
If a login name or user ID is preceded by a `^', it becomes a negation -
|
|
i.e., files of processes owned by the login name or user ID will never
|
|
be listed.
|
|
A negated login name or user ID selection is neither ANDed nor ORed
|
|
with other selections; it is applied before all other selections and
|
|
absolutely excludes the listing of the files of the process.
|
|
For example, to direct
|
|
<I>lsof</I>
|
|
|
|
to exclude the listing of files belonging to root processes,
|
|
specify ``-u^root'' or ``-u^0''.
|
|
<DT id="168"><B>-U</B>
|
|
|
|
<DD>
|
|
selects the listing of UNIX domain socket files.
|
|
<DT id="169"><B>-v</B>
|
|
|
|
<DD>
|
|
selects the listing of
|
|
<I>lsof</I>
|
|
|
|
version information, including: revision number;
|
|
when the
|
|
<I>lsof</I>
|
|
|
|
binary was constructed;
|
|
who constructed the binary and where;
|
|
the name of the compiler used to construct the
|
|
<I>lsof binary;</I>
|
|
|
|
the version number of the compiler when readily available;
|
|
the compiler and loader flags used to construct the
|
|
<I>lsof</I>
|
|
|
|
binary;
|
|
and system information, typically the output of
|
|
<I>uname</I>'s
|
|
|
|
<B>-a</B>
|
|
|
|
option.
|
|
<DT id="170"><B>-V</B>
|
|
|
|
<DD>
|
|
directs
|
|
<I>lsof</I>
|
|
|
|
to indicate the items it was asked to list and failed to find - command
|
|
names, file names, Internet addresses or files, login names, NFS files,
|
|
PIDs, PGIDs, and UIDs.
|
|
<DT id="171"><DD>
|
|
When other options are ANDed to search options, or compile-time
|
|
options restrict the listing of some files,
|
|
<I>lsof</I>
|
|
|
|
may not report that it failed to find a search item when an ANDed
|
|
option or compile-time option prevents the listing of the open file
|
|
containing the located search item.
|
|
<DT id="172"><DD>
|
|
For example, ``lsof -V <A HREF="mailto:-iTCP@foobar">-iTCP@foobar</A> -a -d 999'' may not report a
|
|
failure to locate open files at ``<A HREF="mailto:TCP@foobar">TCP@foobar</A>'' and may not list
|
|
any, if none have a file descriptor number of 999.
|
|
A similar situation arises when HASSECURITY and HASNOSOCKSECURITY are
|
|
defined at compile time and they prevent the listing of open files.
|
|
<DT id="173"><B>+|-w</B>
|
|
|
|
<DD>
|
|
Enables (<B>+</B>) or disables (<B>-</B>) the suppression of warning messages.
|
|
<DT id="174"><DD>
|
|
The
|
|
<I>lsof</I>
|
|
|
|
builder may choose to have warning messages disabled or enabled by
|
|
default.
|
|
The default warning message state is indicated in the output of the
|
|
<B>-h</B>
|
|
|
|
or
|
|
<B>-?</B>
|
|
|
|
option.
|
|
Disabling warning messages when they are already disabled or enabling
|
|
them when already enabled is acceptable.
|
|
<DT id="175"><DD>
|
|
The
|
|
<B>-t</B>
|
|
|
|
option selects the
|
|
<B>-w</B>
|
|
|
|
option.
|
|
<DT id="176"><B>-x</B><I> [fl]</I>
|
|
|
|
<DD>
|
|
may accompany the
|
|
<B>+d</B>
|
|
|
|
and
|
|
<B>+D</B>
|
|
|
|
options to direct their processing to cross over symbolic
|
|
links and|or file system mount points encountered when
|
|
scanning the directory (<B>+d</B>) or directory tree (<B>+D</B>).
|
|
<DT id="177"><DD>
|
|
If
|
|
<B>-x</B>
|
|
|
|
is specified by itself without a following parameter, cross-over
|
|
processing of both symbolic links and file system mount points is
|
|
enabled.
|
|
Note that when
|
|
<B>-x</B>
|
|
|
|
is specified without a parameter, the next argument must begin with '-'
|
|
or '+'.
|
|
<DT id="178"><DD>
|
|
The optional 'f' parameter enables file system mount point cross-over
|
|
processing; 'l', symbolic link cross-over processing.
|
|
<DT id="179"><DD>
|
|
The
|
|
<B>-x</B>
|
|
|
|
option may not be supplied without also supplying a
|
|
<B>+d</B>
|
|
|
|
or
|
|
<B>+D</B>
|
|
|
|
option.
|
|
<DT id="180"><B>-X</B>
|
|
|
|
<DD>
|
|
This is a dialect-specific option.
|
|
<DT id="181">
|
|
AIX:
|
|
<DD>
|
|
<DD>This IBM AIX RISC/System 6000 option requests the reporting
|
|
of executed text file and shared library references.
|
|
<DT id="182"><DD>
|
|
<B>WARNING:</B>
|
|
|
|
because this option uses the kernel readx() function, its use on
|
|
a busy AIX system might cause an application process to hang so
|
|
completely that it can neither be killed nor stopped.
|
|
I have never seen this happen or had a report of its happening,
|
|
but I think there is a remote possibility it could happen.
|
|
<DT id="183"><DD>
|
|
By default use of readx() is disabled.
|
|
On AIX 5L and above
|
|
<I>lsof</I>
|
|
|
|
may need setuid-root permission to perform the actions this
|
|
option requests.
|
|
<DT id="184"><DD>
|
|
The
|
|
<I>lsof</I>
|
|
|
|
builder may specify that the
|
|
<B>-X</B>
|
|
|
|
option be restricted to processes whose real UID is root.
|
|
If that has been done, the
|
|
<B>-X</B>
|
|
|
|
option will not appear in the
|
|
<B>-h</B>
|
|
|
|
or
|
|
<B>-?</B>
|
|
|
|
help output unless the real UID of the
|
|
<I>lsof</I>
|
|
|
|
process is root.
|
|
The default
|
|
<I>lsof</I>
|
|
|
|
distribution allows any UID to specify
|
|
<B>-X,</B>
|
|
|
|
so by default it will appear in the help output.
|
|
<DT id="185"><DD>
|
|
When AIX readx() use
|
|
is disabled,
|
|
<I>lsof</I>
|
|
|
|
may not be able to report information for all text and loader file
|
|
references, but it may also avoid exacerbating an AIX
|
|
kernel directory search kernel error, known as the Stale Segment
|
|
ID bug.
|
|
<DT id="186"><DD>
|
|
The readx() function, used by
|
|
<I>lsof</I>
|
|
|
|
or any other program to access some sections of kernel virtual
|
|
memory, can trigger the Stale Segment ID bug.
|
|
It can cause the kernel's dir_search() function to believe erroneously
|
|
that part of an in-memory copy of a file system directory has been
|
|
zeroed.
|
|
Another application process, distinct from
|
|
<I>lsof</I>,
|
|
|
|
asking the kernel to search the directory - e.g., by using
|
|
<I><A HREF="/cgi-bin/man/man2html?2+open">open</A></I>(2) -
|
|
|
|
can cause dir_search() to loop forever, thus hanging the application process.
|
|
<DT id="187"><DD>
|
|
Consult the
|
|
<I>lsof</I>
|
|
|
|
FAQ (The <B>FAQ</B> section gives its location.)
|
|
and the
|
|
<I>00README</I>
|
|
|
|
file of the
|
|
<I>lsof</I>
|
|
|
|
distribution for a more complete description of the Stale Segment ID bug,
|
|
its APAR, and methods for defining readx() use when compiling
|
|
<I>lsof</I>.
|
|
|
|
<DT id="188">
|
|
Linux:
|
|
<DD>
|
|
<DD>This Linux option requests that
|
|
<I>lsof</I>
|
|
|
|
skip the reporting of information on all open TCP, UDP and UDPLITE IPv4
|
|
and IPv6 files.
|
|
<DT id="189"><DD>
|
|
This Linux option is most useful when the system has an extremely
|
|
large number of open TCP, UDP and UDPLITE files, the processing of whose
|
|
information in the
|
|
<I>/proc/net/tcp*</I>
|
|
|
|
and
|
|
<I>/proc/net/udp*</I>
|
|
|
|
files would take
|
|
<I>lsof</I>
|
|
|
|
a long time, and whose reporting is not of interest.
|
|
<DT id="190"><DD>
|
|
Use this option with care and only when you are sure that the
|
|
information you want
|
|
<I>lsof</I>
|
|
|
|
to display isn't associated with open TCP, UDP or UDPLITE socket files.
|
|
<DT id="191">
|
|
Solaris 10 and above:
|
|
<DD>
|
|
<DD>This Solaris 10 and above option requests the reporting of cached
|
|
paths for files that have been deleted - i.e., removed with
|
|
<I><A HREF="/cgi-bin/man/man2html?1+rm">rm</A></I>(1)
|
|
|
|
or
|
|
<I><A HREF="/cgi-bin/man/man2html?2+unlink">unlink</A></I>(2).
|
|
|
|
<DT id="192"><DD>
|
|
The cached path is followed by the string `` (deleted)'' to indicate
|
|
that the path by which the file was opened has been deleted.
|
|
<DT id="193"><DD>
|
|
Because intervening changes made to the path - i.e., renames with
|
|
<I><A HREF="/cgi-bin/man/man2html?1+mv">mv</A></I>(1)
|
|
|
|
or
|
|
<I><A HREF="/cgi-bin/man/man2html?2+rename">rename</A></I>(2)
|
|
|
|
- are not recorded in the cached path, what
|
|
<I>lsof</I>
|
|
|
|
reports is only the path by which the file was opened, not its
|
|
possibly different final path.
|
|
<DT id="194"><B>-z</B><I> [z]</I>
|
|
|
|
<DD>
|
|
specifies how Solaris 10 and higher zone information is to be handled.
|
|
<DT id="195"><DD>
|
|
Without a following argument - e.g., NO
|
|
<I>z</I> -
|
|
|
|
the option specifies that zone names are to be listed in the ZONE
|
|
output column.
|
|
<DT id="196"><DD>
|
|
The
|
|
<B>-z</B>
|
|
|
|
option may be followed by a zone name,
|
|
<B>z</B><I>.</I>
|
|
|
|
That causes lsof to list only open files for processes in that zone.
|
|
Multiple
|
|
<B>-z</B><I> z</I>
|
|
|
|
option and argument pairs may be specified to form a list of named zones.
|
|
Any open file of any process in any of the zones will be listed, subject
|
|
to other conditions specified by other options and arguments.
|
|
<DT id="197"><B>-Z</B><I> [Z]</I>
|
|
|
|
<DD>
|
|
specifies how SELinux security contexts are to be handled.
|
|
It and 'Z' field output character support are inhibited
|
|
when SELinux is disabled in the running Linux kernel.
|
|
See
|
|
<B>OUTPUT FOR OTHER PROGRAMS</B>
|
|
|
|
for more information on the 'Z' field output character.
|
|
<DT id="198"><DD>
|
|
Without a following argument - e.g., NO
|
|
<I>Z</I> -
|
|
|
|
the option specifies that security contexts are to be listed in the
|
|
SECURITY-CONTEXT output column.
|
|
<DT id="199"><DD>
|
|
The
|
|
<B>-Z</B>
|
|
|
|
option may be followed by a wildcard security context name,
|
|
<B>Z</B><I>.</I>
|
|
|
|
That causes lsof to list only open files for processes in that security
|
|
context.
|
|
Multiple
|
|
<B>-Z</B><I> Z</I>
|
|
|
|
option and argument pairs may be specified to form a list of security
|
|
contexts.
|
|
Any open file of any process in any of the security contexts will be listed,
|
|
subject to other conditions specified by other options and arguments.
|
|
Note that
|
|
<I>Z</I>
|
|
|
|
can be A:B:C or *:B:C or A:B:* or *:*:C to match against the A:B:C context.
|
|
<DT id="200"><B>--</B>
|
|
|
|
<DD>
|
|
The double minus sign option is a marker that signals the end of
|
|
the keyed options.
|
|
It may be used, for example, when the first file name begins with
|
|
a minus sign.
|
|
It may also be used when the absence of a value for the last keyed
|
|
option must be signified by the presence of a minus sign in the following
|
|
option and before the start of the file names.
|
|
<DT id="201"><I>names</I>
|
|
|
|
<DD>
|
|
These are path names of specific files to list.
|
|
Symbolic links are resolved before use.
|
|
The first name may be separated from the preceding options with
|
|
the ``--'' option.
|
|
<DT id="202"><DD>
|
|
If a
|
|
<I>name</I>
|
|
|
|
is the mounted-on directory of a file system or the device of the
|
|
file system,
|
|
<I>lsof</I>
|
|
|
|
will list all the files open on the file system.
|
|
To be considered a file system, the
|
|
<I>name</I>
|
|
|
|
must match a mounted-on directory name in
|
|
<I><A HREF="/cgi-bin/man/man2html?8+mount">mount</A></I>(8)
|
|
|
|
output, or match the name of a block device associated with a mounted-on
|
|
directory name.
|
|
The
|
|
<B>+|-f</B>
|
|
|
|
option may be used to force
|
|
<I>lsof</I>
|
|
|
|
to consider a
|
|
<I>name</I>
|
|
|
|
a file system identifier (<B>+f</B>) or a simple file (<B>-f</B>).
|
|
<DT id="203"><DD>
|
|
If
|
|
<I>name</I>
|
|
|
|
is a path to a directory that is not the mounted-on directory name of
|
|
a file system, it is treated just as a regular file is treated - i.e.,
|
|
its listing is restricted to processes that have it open as a file or
|
|
as a process-specific directory, such as the root or current working
|
|
directory.
|
|
To request that
|
|
<I>lsof</I>
|
|
|
|
look for open files inside a directory name, use the
|
|
<B>+d</B><I> s</I>
|
|
|
|
and
|
|
<B>+D</B><I> D</I>
|
|
|
|
options.
|
|
<DT id="204"><DD>
|
|
If a
|
|
<I>name</I>
|
|
|
|
is the base name of a family of multiplexed files - e.g, AIX's
|
|
<I>/dev/pt[cs]</I> -
|
|
|
|
<I>lsof</I>
|
|
|
|
will list all the associated multiplexed files on the device that
|
|
are open - e.g.,
|
|
<I>/dev/pt[cs]/1</I>,
|
|
|
|
<I>/dev/pt[cs]/2</I>,
|
|
|
|
etc.
|
|
<DT id="205"><DD>
|
|
If a
|
|
<I>name</I>
|
|
|
|
is a UNIX domain socket name,
|
|
<I>lsof</I>
|
|
|
|
will usually search for it by the characters of the name alone - exactly as
|
|
it is specified and is recorded in the kernel socket structure.
|
|
(See the next paragraph for an exception to that rule for Linux.)
|
|
Specifying a relative path - e.g.,
|
|
<I>./file</I>
|
|
|
|
- in place of the
|
|
file's absolute path - e.g.,
|
|
<I>/tmp/file</I>
|
|
|
|
- won't work because
|
|
<I>lsof</I>
|
|
|
|
must match the characters you specify with what it finds in the
|
|
kernel UNIX domain socket structures.
|
|
<DT id="206"><DD>
|
|
If a
|
|
<I>name</I>
|
|
|
|
is a Linux UNIX domain socket name, in one case
|
|
<I>lsof</I>
|
|
|
|
is able to search for it by its device and inode number, allowing
|
|
<I>name</I>
|
|
|
|
to be a relative path.
|
|
The case requires that the absolute path -- i.e., one beginning with a
|
|
slash ('/') be used by the process that created the socket, and hence be
|
|
stored in the
|
|
<I>/proc/net/unix</I>
|
|
|
|
file; and it requires that
|
|
<I>lsof</I>
|
|
|
|
be able to obtain the device and node numbers of both the absolute path in
|
|
<I>/proc/net/unix</I>
|
|
|
|
and
|
|
<I>name</I>
|
|
|
|
via successful
|
|
<I><A HREF="/cgi-bin/man/man2html?2+stat">stat</A></I>(2)
|
|
|
|
system calls.
|
|
When those conditions are met,
|
|
<I>lsof</I>
|
|
|
|
will be able to search for the UNIX domain socket when some path to it is
|
|
is specified in
|
|
<I>name</I>.
|
|
|
|
Thus, for example, if the path is
|
|
<I>/dev/log</I>,
|
|
|
|
and an
|
|
<I>lsof</I>
|
|
|
|
search is initiated when the working directory is
|
|
<I>/dev</I>,
|
|
|
|
then
|
|
<I>name</I>
|
|
|
|
could be
|
|
<I>./log</I>.
|
|
|
|
<DT id="207"><DD>
|
|
If a
|
|
<I>name</I>
|
|
|
|
is none of the above,
|
|
<I>lsof</I>
|
|
|
|
will list any open files whose device and inode match that of the
|
|
specified path
|
|
<I>name</I>.
|
|
|
|
<DT id="208"><DD>
|
|
If you have also specified the
|
|
<B>-b</B>
|
|
|
|
option,
|
|
the only
|
|
<I>names</I>
|
|
|
|
you may safely specify are file systems for which your mount table
|
|
supplies alternate device numbers.
|
|
See the
|
|
<B>AVOIDING KERNEL BLOCKS</B>
|
|
|
|
and
|
|
<B>ALTERNATE DEVICE NUMBERS</B>
|
|
|
|
sections for more information.
|
|
<DT id="209"><DD>
|
|
Multiple file names are joined in a single ORed set before
|
|
participating in AND option selection.
|
|
</DL>
|
|
<A NAME="lbAF"> </A>
|
|
<H2>AFS</H2>
|
|
|
|
<I>Lsof</I>
|
|
|
|
supports the recognition of AFS files for these dialects (and AFS
|
|
versions):
|
|
<P>
|
|
|
|
<PRE>
|
|
AIX 4.1.4 (AFS 3.4a)
|
|
HP-UX 9.0.5 (AFS 3.4a)
|
|
Linux 1.2.13 (AFS 3.3)
|
|
Solaris 2.[56] (AFS 3.4a)
|
|
</PRE>
|
|
|
|
<P>
|
|
|
|
It may recognize AFS files on other versions of these dialects,
|
|
but has not been tested there.
|
|
Depending on how AFS is implemented,
|
|
<I>lsof</I>
|
|
|
|
may recognize AFS files in other dialects, or may have difficulties
|
|
recognizing AFS files in the supported dialects.
|
|
<P>
|
|
|
|
<I>Lsof</I>
|
|
|
|
may have trouble identifying all aspects of AFS files in
|
|
supported dialects when AFS kernel support is implemented via
|
|
dynamic modules whose addresses do not appear in the kernel's
|
|
variable name list.
|
|
In that case,
|
|
<I>lsof</I>
|
|
|
|
may have to guess at the identity of AFS files, and might not be able to
|
|
obtain volume information from the kernel that is needed for calculating
|
|
AFS volume node numbers.
|
|
When
|
|
<I>lsof</I>
|
|
|
|
can't compute volume node numbers, it reports blank in the NODE column.
|
|
<P>
|
|
|
|
The
|
|
<B>-A</B><I> A</I>
|
|
|
|
option is available in some dialect implementations of
|
|
<I>lsof</I>
|
|
|
|
for specifying the name list file where dynamic module kernel
|
|
addresses may be found.
|
|
When this option is available, it will be listed in the
|
|
<I>lsof</I>
|
|
|
|
help output, presented in response to the
|
|
<B>-h</B>
|
|
|
|
or
|
|
<B>-?</B>
|
|
|
|
<P>
|
|
|
|
See the
|
|
<I>lsof</I>
|
|
|
|
FAQ (The <B>FAQ</B> section gives its location.)
|
|
for more information about dynamic modules, their
|
|
symbols, and how they affect
|
|
<I>lsof</I>
|
|
|
|
options.
|
|
<P>
|
|
|
|
Because AFS path lookups don't seem to participate in the
|
|
kernel's name cache operations,
|
|
<I>lsof</I>
|
|
|
|
can't identify path name components for AFS files.
|
|
<A NAME="lbAG"> </A>
|
|
<H2>SECURITY</H2>
|
|
|
|
<I>Lsof</I>
|
|
|
|
has three features that may cause security concerns.
|
|
First, its default compilation mode allows anyone to list all
|
|
open files with it.
|
|
Second, by default it creates a user-readable and user-writable device
|
|
cache file in the home directory of the real user ID that executes
|
|
<I>lsof</I>.
|
|
|
|
(The list-all-open-files and device cache features may be disabled when
|
|
<I>lsof</I>
|
|
|
|
is compiled.)
|
|
Third, its
|
|
<B>-k</B>
|
|
|
|
and
|
|
<B>-m</B>
|
|
|
|
options name alternate kernel name list or memory files.
|
|
<P>
|
|
|
|
Restricting the listing of all open files is controlled by the
|
|
compile-time HASSECURITY and HASNOSOCKSECURITY options.
|
|
When HASSECURITY is defined,
|
|
<I>lsof</I>
|
|
|
|
will allow only the root user to list all open files.
|
|
The non-root user may list only open files of processes with the same user
|
|
IDentification number as the real user ID number of the
|
|
<I>lsof</I>
|
|
|
|
process (the one that its user logged on with).
|
|
<P>
|
|
|
|
However, if HASSECURITY and HASNOSOCKSECURITY are both defined,
|
|
anyone may list open socket files, provided they are selected
|
|
with the
|
|
<B>-i</B>
|
|
|
|
option.
|
|
<P>
|
|
|
|
When HASSECURITY is not defined, anyone may list all open files.
|
|
<P>
|
|
|
|
Help output, presented in response to the
|
|
<B>-h</B>
|
|
|
|
or
|
|
<B>-?</B>
|
|
|
|
option, gives the status of the HASSECURITY and HASNOSOCKSECURITY definitions.
|
|
<P>
|
|
|
|
See the
|
|
<B>Security</B>
|
|
|
|
section of the
|
|
<I>00README</I>
|
|
|
|
file of the
|
|
<I>lsof</I>
|
|
|
|
distribution for information on building
|
|
<I>lsof</I>
|
|
|
|
with the HASSECURITY and HASNOSOCKSECURITY options enabled.
|
|
<P>
|
|
|
|
Creation and use of a user-readable and user-writable device
|
|
cache file is controlled by the compile-time HASDCACHE option.
|
|
See the
|
|
<B>DEVICE CACHE FILE</B>
|
|
|
|
section and the sections that follow it for details on how its path
|
|
is formed.
|
|
For security considerations it is important to note that in the default
|
|
<I>lsof</I>
|
|
|
|
distribution, if the real user ID under which
|
|
<I>lsof</I>
|
|
|
|
is executed is root, the device cache file will be written in root's
|
|
home directory - e.g.,
|
|
<I>/</I>
|
|
|
|
or
|
|
<I>/root</I>.
|
|
|
|
When HASDCACHE is not defined,
|
|
<I>lsof</I>
|
|
|
|
does not write or attempt to read a device cache file.
|
|
<P>
|
|
|
|
When HASDCACHE is defined, the
|
|
<I>lsof</I>
|
|
|
|
help output, presented in response to the
|
|
<B>-h</B>,
|
|
|
|
<B>-D?</B>,
|
|
|
|
or
|
|
<B>-?</B>
|
|
|
|
options, will provide device cache file handling information.
|
|
When HASDCACHE is not defined, the
|
|
<B>-h</B>
|
|
|
|
or
|
|
<B>-?</B>
|
|
|
|
output will have no
|
|
<B>-D</B>
|
|
|
|
option description.
|
|
<P>
|
|
|
|
Before you decide to disable the device cache file feature - enabling
|
|
it improves the performance of
|
|
<I>lsof</I>
|
|
|
|
by reducing the startup overhead of examining all the nodes in
|
|
<I>/dev</I>
|
|
|
|
(or
|
|
<I>/devices</I>)
|
|
|
|
- read the discussion of it in the
|
|
<I>00DCACHE</I>
|
|
|
|
file of the
|
|
<I>lsof</I>
|
|
|
|
distribution and the
|
|
<I>lsof</I>
|
|
|
|
FAQ (The <B>FAQ</B> section gives its location.)
|
|
<P>
|
|
|
|
WHEN IN DOUBT, YOU CAN TEMPORARILY DISABLE THE USE OF THE DEVICE CACHE FILE
|
|
WITH THE
|
|
<B>-Di</B>
|
|
|
|
OPTION.
|
|
<P>
|
|
|
|
When
|
|
<I>lsof</I>
|
|
|
|
user declares alternate kernel name list or memory files with the
|
|
<B>-k</B>
|
|
|
|
and
|
|
<B>-m</B>
|
|
|
|
options,
|
|
<I>lsof</I>
|
|
|
|
checks the user's authority to read them with
|
|
<I><A HREF="/cgi-bin/man/man2html?2+access">access</A></I>(2).
|
|
|
|
This is intended to prevent whatever special power
|
|
<I>lsof's</I>
|
|
|
|
modes might confer on it from letting it read files not normally
|
|
accessible via the authority of the real user ID.
|
|
<A NAME="lbAH"> </A>
|
|
<H2>OUTPUT</H2>
|
|
|
|
This section describes the information
|
|
<I>lsof</I>
|
|
|
|
lists for each open file.
|
|
See the
|
|
<B>OUTPUT FOR OTHER PROGRAMS</B>
|
|
|
|
section for additional information on output that can be processed
|
|
by another program.
|
|
<P>
|
|
|
|
<I>Lsof</I>
|
|
|
|
only outputs printable (declared so by
|
|
<I><A HREF="/cgi-bin/man/man2html?3+isprint">isprint</A></I>(3))
|
|
|
|
8 bit characters.
|
|
Non-printable characters are printed in one of three forms:
|
|
the C ``\[bfrnt]'' form;
|
|
the control character `^' form (e.g., ``^@'');
|
|
or hexadecimal leading ``\x'' form (e.g., ``\xab'').
|
|
Space is non-printable in the COMMAND column (``\x20'')
|
|
and printable elsewhere.
|
|
<P>
|
|
|
|
For some dialects - if HASSETLOCALE is defined in the dialect's
|
|
machine.h header file -
|
|
<I>lsof</I>
|
|
|
|
will print the extended 8 bit characters of a language locale.
|
|
The
|
|
<I>lsof</I>
|
|
|
|
process must be supplied a language locale environment variable
|
|
(e.g., LANG) whose value represents a known language locale
|
|
in which the extended characters are considered printable by
|
|
<I><A HREF="/cgi-bin/man/man2html?3+isprint">isprint</A></I>(3).
|
|
|
|
Otherwise
|
|
<I>lsof</I>
|
|
|
|
considers the extended characters non-printable and prints them according
|
|
to its rules for non-printable characters, stated above.
|
|
Consult your dialect's
|
|
<I><A HREF="/cgi-bin/man/man2html?3+setlocale">setlocale</A></I>(3)
|
|
|
|
man page for the names of other environment variables that may
|
|
be used in place of LANG - e.g., LC_ALL, LC_CTYPE, etc.
|
|
<P>
|
|
|
|
<I>Lsof's</I>
|
|
|
|
language locale support for a dialect also covers wide characters - e.g.,
|
|
UTF-8 - when HASSETLOCALE and HASWIDECHAR are defined in the dialect's
|
|
machine.h header file, and when a suitable language locale has been defined
|
|
in the appropriate environment variable for the
|
|
<I>lsof</I>
|
|
|
|
process.
|
|
Wide characters are printable under those conditions if
|
|
<I><A HREF="/cgi-bin/man/man2html?3+iswprint">iswprint</A></I>(3)
|
|
|
|
reports them to be.
|
|
If HASSETLOCALE, HASWIDECHAR and a suitable language locale aren't defined,
|
|
or if
|
|
<I><A HREF="/cgi-bin/man/man2html?3+iswprint">iswprint</A></I>(3)
|
|
|
|
reports wide characters that aren't printable,
|
|
<I>lsof</I>
|
|
|
|
considers the wide characters non-printable and prints each of their
|
|
8 bits according to its rules for non-printable characters, stated above.
|
|
<P>
|
|
|
|
Consult the answers to the "Language locale support" questions in the
|
|
lsof FAQ (The <B>FAQ</B> section gives its location.) for more information.
|
|
<P>
|
|
|
|
<I>Lsof</I>
|
|
|
|
dynamically sizes the output columns each time it runs, guaranteeing
|
|
that each column is a minimum size.
|
|
It also guarantees that each column is separated from its predecessor
|
|
by at least one space.
|
|
<DL COMPACT>
|
|
<DT id="210">COMMAND<DD>
|
|
contains the first nine characters of the name of the UNIX command
|
|
associated with the process.
|
|
If a non-zero
|
|
<I>w</I>
|
|
|
|
value is specified to the
|
|
<B>+c</B><I> w</I>
|
|
|
|
option, the column contains the first
|
|
<I>w</I>
|
|
|
|
characters of the name of the UNIX command associated with the process
|
|
up to the limit of characters supplied to
|
|
<I>lsof</I>
|
|
|
|
by the UNIX dialect.
|
|
(See the description of the
|
|
<B>+c</B><I> w</I>
|
|
|
|
command or the
|
|
<I>lsof</I>
|
|
|
|
FAQ for more information.
|
|
The <B>FAQ</B> section gives its location.)
|
|
<DT id="211"><DD>
|
|
If
|
|
<I>w</I>
|
|
|
|
is less than the length of the column title, ``COMMAND'', it will
|
|
be raised to that length.
|
|
<DT id="212"><DD>
|
|
If a zero
|
|
<I>w</I>
|
|
|
|
value is specified to the
|
|
<B>+c</B><I> w</I>
|
|
|
|
option, the column contains all the characters of the name of the UNIX command
|
|
associated with the process.
|
|
<DT id="213"><DD>
|
|
All command name characters maintained by the kernel in its structures
|
|
are displayed in field output when the command name descriptor (`c')
|
|
is specified.
|
|
See the
|
|
<B>OUTPUT FOR OTHER COMMANDS</B>
|
|
|
|
section for information on selecting field output and the associated
|
|
command name descriptor.
|
|
<DT id="214">PID<DD>
|
|
is the Process IDentification number of the process.
|
|
<DT id="215">TID<DD>
|
|
is the task (thread) IDentification number, if task (thread)
|
|
reporting is supported by the dialect and a task (thread) is
|
|
being listed.
|
|
(If help output - i.e., the output of the
|
|
<B>-h</B>
|
|
|
|
or
|
|
<B>-?</B>
|
|
|
|
options - shows this option, then task (thread) reporting is
|
|
supported by the dialect.)
|
|
<DT id="216"><DD>
|
|
A blank TID column in Linux indicates a process - i.e., a non-task.
|
|
<DT id="217">TASKCMD<DD>
|
|
is the task command name.
|
|
Generally this will be the same as the process named in the COMMAND
|
|
column, but some task implementations (e.g., Linux) permit a task to
|
|
change its command name.
|
|
<DT id="218"><DD>
|
|
The TASKCMD column width is subject to the same size limitation as the
|
|
COMMAND column.
|
|
<DT id="219">ZONE<DD>
|
|
is the Solaris 10 and higher zone name.
|
|
This column must be selected with the
|
|
<B>-z</B>
|
|
|
|
option.
|
|
<DT id="220">SECURITY-CONTEXT<DD>
|
|
is the SELinux security context.
|
|
This column must be selected with the
|
|
<B>-Z</B>
|
|
|
|
option.
|
|
Note that the
|
|
<B>-Z</B>
|
|
|
|
option is inhibited when SELinux is disabled in the running Linux
|
|
kernel.
|
|
<DT id="221">PPID<DD>
|
|
is the Parent Process IDentification number of the process.
|
|
It is only displayed when the
|
|
<B>-R</B>
|
|
|
|
option has been specified.
|
|
<DT id="222">PGID<DD>
|
|
is the process group IDentification number associated with
|
|
the process.
|
|
It is only displayed when the
|
|
<B>-g</B>
|
|
|
|
option has been specified.
|
|
<DT id="223">USER<DD>
|
|
is the user ID number or login name of the user to whom
|
|
the process belongs, usually the same as reported by
|
|
<I><A HREF="/cgi-bin/man/man2html?1+ps">ps</A></I>(1).
|
|
|
|
However, on Linux USER is the user ID number or login that owns
|
|
the directory in /proc where
|
|
<I>lsof</I>
|
|
|
|
finds information about the process.
|
|
Usually that is the same value reported by
|
|
<I><A HREF="/cgi-bin/man/man2html?1+ps">ps</A></I>(1),
|
|
|
|
but may differ when the process has changed its effective user ID.
|
|
(See the
|
|
<B>-l</B>
|
|
|
|
option description for information on when a user ID number or
|
|
login name is displayed.)
|
|
<DT id="224">FD<DD>
|
|
is the File Descriptor number of the file or:
|
|
<DT id="225"><DD>
|
|
<PRE>
|
|
<B>cwd</B> current working directory;
|
|
<BR>
|
|
<B>L</B><I>nn</I> library references (AIX);
|
|
<BR>
|
|
<B>err</B> FD information error (see NAME column);
|
|
<BR>
|
|
<B>jld</B> jail directory (FreeBSD);
|
|
<BR>
|
|
<B>ltx</B> shared library text (code and data);
|
|
<BR>
|
|
<B>Mxx</B> hex memory-mapped type number xx.
|
|
<BR>
|
|
<B>m86</B> DOS Merge mapped file;
|
|
<BR>
|
|
<B>mem</B> memory-mapped file;
|
|
<BR>
|
|
<B>mmap</B> memory-mapped device;
|
|
<BR>
|
|
<B>pd</B> parent directory;
|
|
<BR>
|
|
<B>rtd</B> root directory;
|
|
<BR>
|
|
<B>tr</B> kernel trace file (OpenBSD);
|
|
<BR>
|
|
<B>txt</B> program text (code and data);
|
|
<BR>
|
|
<B>v86</B> VP/ix mapped file;
|
|
</PRE>
|
|
|
|
<DT id="226"><DD>
|
|
FD is followed by one of these characters, describing the mode under which
|
|
the file is open:
|
|
<DT id="227"><DD>
|
|
<TT> </TT><B>r</B> for read access;<BR>
|
|
<BR>
|
|
|
|
<TT> </TT><B>w</B> for write access;<BR>
|
|
<BR>
|
|
|
|
<TT> </TT><B>u</B> for read and write access;<BR>
|
|
<BR>
|
|
|
|
<TT> </TT>space if mode unknown and no lock<BR>
|
|
<BR>
|
|
|
|
<TT> </TT><TT> </TT>character follows;<BR>
|
|
<BR>
|
|
|
|
<TT> </TT>`-' if mode unknown and lock<BR>
|
|
<BR>
|
|
|
|
<TT> </TT><TT> </TT>character follows.<BR>
|
|
<DT id="228"><DD>
|
|
The mode character is followed by one of these lock characters, describing
|
|
the type of lock applied to the file:
|
|
<DT id="229"><DD>
|
|
<TT> </TT><B>N</B> for a Solaris NFS lock of unknown type;<BR>
|
|
<BR>
|
|
|
|
<TT> </TT><B>r</B> for read lock on part of the file;<BR>
|
|
<BR>
|
|
|
|
<TT> </TT><B>R</B> for a read lock on the entire file;<BR>
|
|
<BR>
|
|
|
|
<TT> </TT><B>w</B> for a write lock on part of the file;<BR>
|
|
<BR>
|
|
|
|
<TT> </TT><B>W</B> for a write lock on the entire file;<BR>
|
|
<BR>
|
|
|
|
<TT> </TT><B>u</B> for a read and write lock of any length;<BR>
|
|
<BR>
|
|
|
|
<TT> </TT><B>U</B> for a lock of unknown type;<BR>
|
|
<BR>
|
|
|
|
<TT> </TT><B>x</B> for an SCO OpenServer Xenix lock on part<BR>
|
|
<TT> </TT>of the file;<BR>
|
|
<BR>
|
|
|
|
<TT> </TT><B>X</B> for an SCO OpenServer Xenix lock on the entire file;<BR>
|
|
<BR>
|
|
|
|
<TT> </TT>space if there is no lock.<BR>
|
|
<DT id="230"><DD>
|
|
See the
|
|
<B>LOCKS</B>
|
|
|
|
section for more information on the lock information character.
|
|
<DT id="231"><DD>
|
|
The FD column contents constitutes a single field for parsing in
|
|
post-processing scripts.
|
|
<DT id="232">TYPE<DD>
|
|
is the type of the node associated with the file - e.g., GDIR, GREG,
|
|
VDIR, VREG, etc.
|
|
<DT id="233"><DD>
|
|
or ``IPv4'' for an IPv4 socket;
|
|
<DT id="234"><DD>
|
|
or ``IPv6'' for an open IPv6 network file - even if its address is
|
|
IPv4, mapped in an IPv6 address;
|
|
<DT id="235"><DD>
|
|
or ``ax25'' for a Linux AX.25 socket;
|
|
<DT id="236"><DD>
|
|
or ``inet'' for an Internet domain socket;
|
|
<DT id="237"><DD>
|
|
or ``lla'' for a HP-UX link level access file;
|
|
<DT id="238"><DD>
|
|
or ``rte'' for an AF_ROUTE socket;
|
|
<DT id="239"><DD>
|
|
or ``sock'' for a socket of unknown domain;
|
|
<DT id="240"><DD>
|
|
or ``unix'' for a UNIX domain socket;
|
|
<DT id="241"><DD>
|
|
or ``x.25'' for an HP-UX x.25 socket;
|
|
<DT id="242"><DD>
|
|
or ``BLK'' for a block special file;
|
|
<DT id="243"><DD>
|
|
or ``CHR'' for a character special file;
|
|
<DT id="244"><DD>
|
|
or ``DEL'' for a Linux map file that has been deleted;
|
|
<DT id="245"><DD>
|
|
or ``DIR'' for a directory;
|
|
<DT id="246"><DD>
|
|
or ``DOOR'' for a VDOOR file;
|
|
<DT id="247"><DD>
|
|
or ``FIFO'' for a FIFO special file;
|
|
<DT id="248"><DD>
|
|
or ``KQUEUE'' for a BSD style kernel event queue file;
|
|
<DT id="249"><DD>
|
|
or ``LINK'' for a symbolic link file;
|
|
<DT id="250"><DD>
|
|
or ``MPB'' for a multiplexed block file;
|
|
<DT id="251"><DD>
|
|
or ``MPC'' for a multiplexed character file;
|
|
<DT id="252"><DD>
|
|
or ``NOFD'' for a Linux /proc/<PID>/fd directory that can't be opened --
|
|
the directory path appears in the NAME column, followed by an error
|
|
message;
|
|
<DT id="253"><DD>
|
|
or ``PAS'' for a
|
|
<I>/proc/as</I>
|
|
|
|
file;
|
|
<DT id="254"><DD>
|
|
or ``PAXV'' for a
|
|
<I>/proc/auxv</I>
|
|
|
|
file;
|
|
<DT id="255"><DD>
|
|
or ``PCRE'' for a
|
|
<I>/proc/cred</I>
|
|
|
|
file;
|
|
<DT id="256"><DD>
|
|
or ``PCTL'' for a
|
|
<I>/proc</I>
|
|
|
|
control file;
|
|
<DT id="257"><DD>
|
|
or ``PCUR'' for the current
|
|
<I>/proc</I>
|
|
|
|
process;
|
|
<DT id="258"><DD>
|
|
or ``PCWD'' for a
|
|
<I>/proc</I>
|
|
|
|
current working directory;
|
|
<DT id="259"><DD>
|
|
or ``PDIR'' for a
|
|
<I>/proc</I>
|
|
|
|
directory;
|
|
<DT id="260"><DD>
|
|
or ``PETY'' for a
|
|
<I>/proc</I>
|
|
|
|
executable type (<I>etype</I>);
|
|
<DT id="261"><DD>
|
|
or ``PFD'' for a
|
|
<I>/proc</I>
|
|
|
|
file descriptor;
|
|
<DT id="262"><DD>
|
|
or ``PFDR'' for a
|
|
<I>/proc</I>
|
|
|
|
file descriptor directory;
|
|
<DT id="263"><DD>
|
|
or ``PFIL'' for an executable
|
|
<I>/proc</I>
|
|
|
|
file;
|
|
<DT id="264"><DD>
|
|
or ``PFPR'' for a
|
|
<I>/proc</I>
|
|
|
|
FP register set;
|
|
<DT id="265"><DD>
|
|
or ``PGD'' for a
|
|
<I>/proc/pagedata</I>
|
|
|
|
file;
|
|
<DT id="266"><DD>
|
|
or ``PGID'' for a
|
|
<I>/proc</I>
|
|
|
|
group notifier file;
|
|
<DT id="267"><DD>
|
|
or ``PIPE'' for pipes;
|
|
<DT id="268"><DD>
|
|
or ``PLC'' for a
|
|
<I>/proc/lwpctl</I>
|
|
|
|
file;
|
|
<DT id="269"><DD>
|
|
or ``PLDR'' for a
|
|
<I>/proc/lpw</I>
|
|
|
|
directory;
|
|
<DT id="270"><DD>
|
|
or ``PLDT'' for a
|
|
<I>/proc/ldt</I>
|
|
|
|
file;
|
|
<DT id="271"><DD>
|
|
or ``PLPI'' for a
|
|
<I>/proc/lpsinfo</I>
|
|
|
|
file;
|
|
<DT id="272"><DD>
|
|
or ``PLST'' for a
|
|
<I>/proc/lstatus</I>
|
|
|
|
file;
|
|
<DT id="273"><DD>
|
|
or ``PLU'' for a
|
|
<I>/proc/lusage</I>
|
|
|
|
file;
|
|
<DT id="274"><DD>
|
|
or ``PLWG'' for a
|
|
<I>/proc/gwindows</I>
|
|
|
|
file;
|
|
<DT id="275"><DD>
|
|
or ``PLWI'' for a
|
|
<I>/proc/lwpsinfo</I>
|
|
|
|
file;
|
|
<DT id="276"><DD>
|
|
or ``PLWS'' for a
|
|
<I>/proc/lwpstatus</I>
|
|
|
|
file;
|
|
<DT id="277"><DD>
|
|
or ``PLWU'' for a
|
|
<I>/proc/lwpusage</I>
|
|
|
|
file;
|
|
<DT id="278"><DD>
|
|
or ``PLWX'' for a
|
|
<I>/proc/xregs</I>
|
|
|
|
file;
|
|
<DT id="279"><DD>
|
|
or ``PMAP'' for a
|
|
<I>/proc</I>
|
|
|
|
map file (<I>map</I>);
|
|
<DT id="280"><DD>
|
|
or ``PMEM'' for a
|
|
<I>/proc</I>
|
|
|
|
memory image file;
|
|
<DT id="281"><DD>
|
|
or ``PNTF'' for a
|
|
<I>/proc</I>
|
|
|
|
process notifier file;
|
|
<DT id="282"><DD>
|
|
or ``POBJ'' for a
|
|
<I>/proc/object</I>
|
|
|
|
file;
|
|
<DT id="283"><DD>
|
|
or ``PODR'' for a
|
|
<I>/proc/object</I>
|
|
|
|
directory;
|
|
<DT id="284"><DD>
|
|
or ``POLP'' for an old format
|
|
<I>/proc</I>
|
|
|
|
light weight process file;
|
|
<DT id="285"><DD>
|
|
or ``POPF'' for an old format
|
|
<I>/proc</I>
|
|
|
|
PID file;
|
|
<DT id="286"><DD>
|
|
or ``POPG'' for an old format
|
|
<I>/proc</I>
|
|
|
|
page data file;
|
|
<DT id="287"><DD>
|
|
or ``PORT'' for a SYSV named pipe;
|
|
<DT id="288"><DD>
|
|
or ``PREG'' for a
|
|
<I>/proc</I>
|
|
|
|
register file;
|
|
<DT id="289"><DD>
|
|
or ``PRMP'' for a
|
|
<I>/proc/rmap</I>
|
|
|
|
file;
|
|
<DT id="290"><DD>
|
|
or ``PRTD'' for a
|
|
<I>/proc</I>
|
|
|
|
root directory;
|
|
<DT id="291"><DD>
|
|
or ``PSGA'' for a
|
|
<I>/proc/sigact</I>
|
|
|
|
file;
|
|
<DT id="292"><DD>
|
|
or ``PSIN'' for a
|
|
<I>/proc/psinfo</I>
|
|
|
|
file;
|
|
<DT id="293"><DD>
|
|
or ``PSTA'' for a
|
|
<I>/proc</I>
|
|
|
|
status file;
|
|
<DT id="294"><DD>
|
|
or ``PSXSEM'' for a POSIX semaphore file;
|
|
<DT id="295"><DD>
|
|
or ``PSXSHM'' for a POSIX shared memory file;
|
|
<DT id="296"><DD>
|
|
or ``PTS'' for a
|
|
<I>/dev/pts</I>
|
|
|
|
file;
|
|
<DT id="297"><DD>
|
|
or ``PUSG'' for a
|
|
<I>/proc/usage</I>
|
|
|
|
file;
|
|
<DT id="298"><DD>
|
|
or ``PW'' for a
|
|
<I>/proc/watch</I>
|
|
|
|
file;
|
|
<DT id="299"><DD>
|
|
or ``PXMP'' for a
|
|
<I>/proc/xmap</I>
|
|
|
|
file;
|
|
<DT id="300"><DD>
|
|
or ``REG'' for a regular file;
|
|
<DT id="301"><DD>
|
|
or ``SMT'' for a shared memory transport file;
|
|
<DT id="302"><DD>
|
|
or ``STSO'' for a stream socket;
|
|
<DT id="303"><DD>
|
|
or ``UNNM'' for an unnamed type file;
|
|
<DT id="304"><DD>
|
|
or ``XNAM'' for an OpenServer Xenix special file of unknown type;
|
|
<DT id="305"><DD>
|
|
or ``XSEM'' for an OpenServer Xenix semaphore file;
|
|
<DT id="306"><DD>
|
|
or ``XSD'' for an OpenServer Xenix shared data file;
|
|
<DT id="307"><DD>
|
|
or the four type number octets if the corresponding name isn't known.
|
|
<DT id="308">FILE-ADDR<DD>
|
|
contains the kernel file structure address when
|
|
<B>f</B>
|
|
|
|
has been specified to
|
|
<B>+f</B>;
|
|
|
|
<DT id="309">FCT<DD>
|
|
contains the file reference count from the kernel file structure when
|
|
<B>c</B>
|
|
|
|
has been specified to
|
|
<B>+f</B>;
|
|
|
|
<DT id="310">FILE-FLAG<DD>
|
|
when
|
|
<B>g</B>
|
|
|
|
or
|
|
<B>G</B>
|
|
|
|
has been specified to
|
|
<B>+f</B>,
|
|
|
|
this field contains the contents of the f_flag[s] member of the kernel
|
|
file structure and the kernel's per-process open file flags (if available);
|
|
`G' causes them to be displayed in hexadecimal;
|
|
`g', as short-hand names;
|
|
two lists may be displayed with entries separated by commas, the
|
|
lists separated by a semicolon (`;');
|
|
the first list may contain short-hand names for f_flag[s] values from
|
|
the following table:
|
|
<DT id="311"><DD>
|
|
<PRE>
|
|
AIO asynchronous I/O (e.g., FAIO)
|
|
AP append
|
|
ASYN asynchronous I/O (e.g., FASYNC)
|
|
BAS block, test, and set in use
|
|
BKIU block if in use
|
|
BL use block offsets
|
|
BSK block seek
|
|
CA copy avoid
|
|
CIO concurrent I/O
|
|
CLON clone
|
|
CLRD CL read
|
|
CR create
|
|
DF defer
|
|
DFI defer IND
|
|
DFLU data flush
|
|
DIR direct
|
|
DLY delay
|
|
DOCL do clone
|
|
DSYN data-only integrity
|
|
DTY must be a directory
|
|
EVO event only
|
|
EX open for exec
|
|
EXCL exclusive open
|
|
FSYN synchronous writes
|
|
GCDF defer during unp_gc() (AIX)
|
|
GCMK mark during unp_gc() (AIX)
|
|
GTTY accessed via /dev/tty
|
|
HUP HUP in progress
|
|
KERN kernel
|
|
KIOC kernel-issued ioctl
|
|
LCK has lock
|
|
LG large file
|
|
MBLK stream message block
|
|
MK mark
|
|
MNT mount
|
|
MSYN multiplex synchronization
|
|
NATM don't update atime
|
|
NB non-blocking I/O
|
|
NBDR no BDRM check
|
|
NBIO SYSV non-blocking I/O
|
|
NBF n-buffering in effect
|
|
NC no cache
|
|
ND no delay
|
|
NDSY no data synchronization
|
|
NET network
|
|
NFLK don't follow links
|
|
NMFS NM file system
|
|
NOTO disable background stop
|
|
NSH no share
|
|
NTTY no controlling TTY
|
|
OLRM OLR mirror
|
|
PAIO POSIX asynchronous I/O
|
|
PP POSIX pipe
|
|
R read
|
|
RC file and record locking cache
|
|
REV revoked
|
|
RSH shared read
|
|
RSYN read synchronization
|
|
RW read and write access
|
|
SL shared lock
|
|
SNAP cooked snapshot
|
|
SOCK socket
|
|
SQSH Sequent shared set on open
|
|
SQSV Sequent SVM set on open
|
|
SQR Sequent set repair on open
|
|
SQS1 Sequent full shared open
|
|
SQS2 Sequent partial shared open
|
|
STPI stop I/O
|
|
SWR synchronous read
|
|
SYN file integrity while writing
|
|
TCPM avoid TCP collision
|
|
TR truncate
|
|
W write
|
|
WKUP parallel I/O synchronization
|
|
WTG parallel I/O synchronization
|
|
VH vhangup pending
|
|
VTXT virtual text
|
|
XL exclusive lock
|
|
</PRE>
|
|
|
|
<DT id="312"><DD>
|
|
this list of names was derived from F* #define's in dialect header files
|
|
<<A HREF="file:///usr/include/fcntl.h">fcntl.h</A>>, <linux<<A HREF="file:///usr/include//fs.h">/fs.h</A>>, <sys/fcntl.c>, <<A HREF="file:///usr/include/sys/fcntlcom.h">sys/fcntlcom.h</A>>, and <<A HREF="file:///usr/include/sys/file.h">sys/file.h</A>>;
|
|
see the lsof.h header file for a list showing the correspondence
|
|
between the above short-hand names and the header file definitions;
|
|
<DT id="313"><DD>
|
|
the second list (after the semicolon) may contain short-hand names
|
|
for kernel per-process open file flags from this table:
|
|
<DT id="314"><DD>
|
|
<PRE>
|
|
ALLC allocated
|
|
BR the file has been read
|
|
BHUP activity stopped by SIGHUP
|
|
BW the file has been written
|
|
CLSG closing
|
|
CX close-on-exec (see fcntl(F_SETFD))
|
|
LCK lock was applied
|
|
MP memory-mapped
|
|
OPIP open pending - in progress
|
|
RSVW reserved wait
|
|
SHMT UF_FSHMAT set (AIX)
|
|
USE in use (multi-threaded)
|
|
</PRE>
|
|
|
|
<DT id="315">NODE-ID<DD>
|
|
(or INODE-ADDR for some dialects)
|
|
contains a unique identifier for the file node (usually the kernel
|
|
vnode or inode address, but also occasionally a concatenation of
|
|
device and node number) when
|
|
<B>n</B>
|
|
|
|
has been specified to
|
|
<B>+f</B>;
|
|
|
|
<DT id="316">DEVICE<DD>
|
|
contains the device numbers, separated by commas, for a character special,
|
|
block special, regular, directory or NFS file;
|
|
<DT id="317"><DD>
|
|
or ``memory'' for a memory file system node under Tru64 UNIX;
|
|
<DT id="318"><DD>
|
|
or the address of the private data area of a Solaris socket
|
|
stream;
|
|
<DT id="319"><DD>
|
|
or a kernel reference address that identifies the file
|
|
(The kernel reference address may be used for FIFO's, for example.);
|
|
<DT id="320"><DD>
|
|
or
|
|
the base address or device name of a Linux AX.25 socket device.
|
|
<DT id="321"><DD>
|
|
Usually only the lower thirty two bits of Tru64 UNIX kernel addresses
|
|
are displayed.
|
|
<DT id="322">SIZE, SIZE/OFF, or OFFSET<DD>
|
|
is the size of the file or the file offset in bytes.
|
|
A value is displayed in this column only if it is available.
|
|
<I>Lsof</I>
|
|
|
|
displays whatever value - size or offset - is appropriate for the type
|
|
of the file and the version of
|
|
<I>lsof</I>.
|
|
|
|
<DT id="323"><DD>
|
|
On some UNIX dialects
|
|
<I>lsof</I>
|
|
|
|
can't obtain accurate or consistent file offset information from its
|
|
kernel data sources, sometimes just for particular kinds of files
|
|
(e.g., socket files.)
|
|
In other cases, files don't have true sizes - e.g., sockets, FIFOs,
|
|
pipes - so
|
|
<I>lsof</I>
|
|
|
|
displays for their sizes the content amounts it finds in their kernel
|
|
buffer descriptors (e.g., socket buffer size counts or TCP/IP window
|
|
sizes.)
|
|
Consult the
|
|
<I>lsof</I>
|
|
|
|
FAQ (The <B>FAQ</B> section gives its location.)
|
|
for more information.
|
|
<DT id="324"><DD>
|
|
The file size is displayed in decimal;
|
|
the offset is normally displayed in decimal with a leading ``0t'' if
|
|
it contains 8 digits or less; in hexadecimal with a leading ``0x'' if
|
|
it is longer than 8 digits.
|
|
(Consult the
|
|
<B>-o</B><I> o</I>
|
|
|
|
option description for information on when 8 might default to
|
|
some other value.)
|
|
<DT id="325"><DD>
|
|
Thus the leading ``0t'' and ``0x'' identify an offset when the column
|
|
may contain both a size and an offset (i.e., its title is SIZE/OFF).
|
|
<DT id="326"><DD>
|
|
If the
|
|
<B>-o</B>
|
|
|
|
option is specified,
|
|
<I>lsof</I>
|
|
|
|
always displays the file offset (or nothing if no offset is available)
|
|
and labels the column OFFSET.
|
|
The offset always begins with ``0t'' or ``0x'' as described above.
|
|
<DT id="327"><DD>
|
|
The
|
|
<I>lsof</I>
|
|
|
|
user can control the switch from ``0t'' to ``0x'' with the
|
|
<B>-o</B><I> o</I>
|
|
|
|
option.
|
|
Consult its description for more information.
|
|
<DT id="328"><DD>
|
|
If the
|
|
<B>-s</B>
|
|
|
|
option is specified,
|
|
<I>lsof</I>
|
|
|
|
always displays the file size (or nothing if no size is available)
|
|
and labels the column SIZE.
|
|
The
|
|
<B>-o</B>
|
|
|
|
and
|
|
<B>-s</B>
|
|
|
|
options are mutually exclusive; they can't both be specified.
|
|
<DT id="329"><DD>
|
|
For files that don't have a fixed size - e.g., don't reside
|
|
on a disk device -
|
|
<I>lsof</I>
|
|
|
|
will display appropriate information about the current size or
|
|
position of the file if it is available in the kernel structures
|
|
that define the file.
|
|
<DT id="330">NLINK<DD>
|
|
contains the file link count when
|
|
<B>+L</B>
|
|
|
|
has been specified;
|
|
<DT id="331">NODE<DD>
|
|
is the node number of a local file;
|
|
<DT id="332"><DD>
|
|
or the inode number of an NFS file in the server host;
|
|
<DT id="333"><DD>
|
|
or the Internet protocol type - e.g, ``TCP'';
|
|
<DT id="334"><DD>
|
|
or ``STR'' for a stream;
|
|
<DT id="335"><DD>
|
|
or ``CCITT'' for an HP-UX x.25 socket;
|
|
<DT id="336"><DD>
|
|
or the IRQ or inode number of a Linux AX.25 socket device.
|
|
<DT id="337">NAME<DD>
|
|
is the name of the mount point and file system on which the file resides;
|
|
<DT id="338"><DD>
|
|
or the name of a file specified in the
|
|
<I>names</I>
|
|
|
|
option (after any symbolic links have been resolved);
|
|
<DT id="339"><DD>
|
|
or the name of a character special or block special device;
|
|
<DT id="340"><DD>
|
|
or the local and remote Internet addresses of a network file;
|
|
the local host name or IP number is followed by a colon (':'), the
|
|
port, ``->'', and the two-part remote address;
|
|
IP addresses may be reported as numbers or names, depending on the
|
|
<B>+|-M</B>,
|
|
|
|
<B>-n</B>,
|
|
|
|
and
|
|
<B>-P</B>
|
|
|
|
options;
|
|
colon-separated IPv6 numbers are enclosed in square brackets;
|
|
IPv4 INADDR_ANY and IPv6 IN6_IS_ADDR_UNSPECIFIED addresses, and
|
|
zero port numbers are represented by an asterisk ('*');
|
|
a UDP destination address may be followed by the amount of time
|
|
elapsed since the last packet was sent to the destination;
|
|
TCP, UDP and UDPLITE remote addresses may be followed by TCP/TPI
|
|
information in parentheses - state (e.g., ``(ESTABLISHED)'', ``(Unbound)''),
|
|
queue sizes, and window sizes (not all dialects) - in a fashion
|
|
similar to what
|
|
<I><A HREF="/cgi-bin/man/man2html?1+netstat">netstat</A></I>(1)
|
|
|
|
reports;
|
|
see the
|
|
<B>-T</B>
|
|
|
|
option description or the description of the TCP/TPI field in
|
|
<B>OUTPUT FOR OTHER PROGRAMS</B>
|
|
|
|
for more information on state, queue size, and window size;
|
|
<DT id="341"><DD>
|
|
or the address or name of a UNIX domain socket, possibly including
|
|
a stream clone device name, a file system object's path name, local
|
|
and foreign kernel addresses, socket pair information, and a bound
|
|
vnode address;
|
|
<DT id="342"><DD>
|
|
or the local and remote mount point names of an NFS file;
|
|
<DT id="343"><DD>
|
|
or ``STR'', followed by the stream name;
|
|
<DT id="344"><DD>
|
|
or a stream character device name, followed by ``->'' and the stream name
|
|
or a list of stream module names, separated by ``->'';
|
|
<DT id="345"><DD>
|
|
or ``STR:'' followed by the SCO OpenServer stream device and module
|
|
names, separated by ``->'';
|
|
<DT id="346"><DD>
|
|
or system directory name, `` -- '', and as many components of the path
|
|
name as
|
|
<I>lsof</I>
|
|
|
|
can find in the kernel's name cache for selected dialects
|
|
(See the
|
|
<B>KERNEL NAME CACHE</B>
|
|
|
|
section for more information.);
|
|
<DT id="347"><DD>
|
|
or ``PIPE->'', followed by a Solaris kernel pipe destination address;
|
|
<DT id="348"><DD>
|
|
or ``COMMON:'', followed by the vnode device information structure's
|
|
device name, for a Solaris common vnode;
|
|
<DT id="349"><DD>
|
|
or the address family, followed by a slash (`/'), followed by fourteen
|
|
comma-separated bytes of a non-Internet raw socket address;
|
|
<DT id="350"><DD>
|
|
or the HP-UX x.25 local address, followed by the virtual connection
|
|
number (if any), followed by the remote address (if any);
|
|
<DT id="351"><DD>
|
|
or ``(dead)'' for disassociated Tru64 UNIX files - typically terminal files
|
|
that have been flagged with the TIOCNOTTY ioctl and closed by daemons;
|
|
<DT id="352"><DD>
|
|
or ``rd=<offset>'' and ``wr=<offset>'' for the values of the
|
|
read and write offsets of a FIFO;
|
|
<DT id="353"><DD>
|
|
or ``clone <I>n</I>:/dev/event'' for SCO OpenServer file clones of the
|
|
<I>/dev/event</I>
|
|
|
|
device, where
|
|
<I>n</I>
|
|
|
|
is the minor device number of the file;
|
|
<DT id="354"><DD>
|
|
or ``(socketpair: n)'' for a Solaris 2.6, 8, 9 or 10
|
|
UNIX domain socket, created by the
|
|
<I><A HREF="/cgi-bin/man/man2html?3N+socketpair">socketpair</A></I>(3N)
|
|
|
|
network function;
|
|
<DT id="355"><DD>
|
|
or ``no PCB'' for socket files that do not have a protocol block
|
|
associated with them, optionally followed by ``, CANTSENDMORE'' if
|
|
sending on the socket has been disabled, or ``, CANTRCVMORE'' if
|
|
receiving on the socket has been disabled (e.g., by the
|
|
<I><A HREF="/cgi-bin/man/man2html?2+shutdown">shutdown</A></I>(2)
|
|
|
|
function);
|
|
<DT id="356"><DD>
|
|
or the local and remote addresses of a Linux IPX socket file
|
|
in the form <net>:[<node>:]<port>, followed in parentheses
|
|
by the transmit and receive queue sizes, and the connection state;
|
|
<DT id="357"><DD>
|
|
or ``dgram'' or ``stream'' for the type UnixWare 7.1.1 and above in-kernel
|
|
UNIX domain sockets, followed by a colon (':') and the local path name
|
|
when available, followed by ``->'' and the remote path name or kernel
|
|
socket address in hexadecimal when available;
|
|
<DT id="358"><DD>
|
|
or the association value, association index, endpoint value, local address,
|
|
local port, remote address and remote port for Linux SCTP sockets;
|
|
<DT id="359"><DD>
|
|
or ``protocol: '' followed by the Linux socket's protocol attribute.
|
|
</DL>
|
|
<P>
|
|
|
|
For dialects that support a ``namefs'' file system, allowing one
|
|
file to be attached to another with
|
|
<I><A HREF="/cgi-bin/man/man2html?3C+fattach">fattach</A></I>(3C),
|
|
|
|
<I>lsof</I>
|
|
|
|
will add ``(FA:<address1><direction><address2>)'' to the NAME column.
|
|
<address1> and <address2> are hexadecimal vnode addresses.
|
|
<direction> will be ``<-'' if <address2> has been fattach'ed to
|
|
this vnode whose address is <address1>;
|
|
and ``->'' if <address1>, the vnode address of this vnode, has been
|
|
fattach'ed to <address2>.
|
|
<address1> may be omitted if it already appears in the DEVICE column.
|
|
<P>
|
|
|
|
<I>Lsof</I>
|
|
|
|
may add two parenthetical notes to the NAME column for open Solaris 10 files:
|
|
``(?)'' if
|
|
<I>lsof</I>
|
|
|
|
considers the path name of questionable accuracy;
|
|
and ``(deleted)'' if the
|
|
<B>-X</B>
|
|
|
|
option has been specified and
|
|
<I>lsof</I>
|
|
|
|
detects the open file's path name has been deleted.
|
|
Consult the
|
|
<I>lsof</I>
|
|
|
|
FAQ (The <B>FAQ</B> section gives its location.)
|
|
for more information on these NAME column additions.
|
|
<A NAME="lbAI"> </A>
|
|
<H2>LOCKS</H2>
|
|
|
|
<I>Lsof</I>
|
|
|
|
can't adequately report the wide variety of UNIX dialect file locks
|
|
in a single character.
|
|
What it reports in a single character is a compromise between the
|
|
information it finds in the kernel and the limitations of the reporting
|
|
format.
|
|
<P>
|
|
|
|
Moreover, when a process holds several byte level locks on a file,
|
|
<I>lsof</I>
|
|
|
|
only reports the status of the first lock it encounters.
|
|
If it is a byte level lock, then the lock character will be reported
|
|
in lower case - i.e., `r', `w', or `x' - rather than the upper case
|
|
equivalent reported for a full file lock.
|
|
<P>
|
|
|
|
Generally
|
|
<I>lsof</I>
|
|
|
|
can only report on locks held by local processes on local files.
|
|
When a local process sets a lock on a remotely mounted (e.g., NFS)
|
|
file, the remote server host usually records the lock state.
|
|
One exception is Solaris - at some patch levels of 2.3, and in all
|
|
versions above 2.4, the Solaris kernel records information on remote
|
|
locks in local structures.
|
|
<P>
|
|
|
|
<I>Lsof</I>
|
|
|
|
has trouble reporting locks for some UNIX dialects.
|
|
Consult the
|
|
<B>BUGS</B>
|
|
|
|
section of this manual page or the
|
|
<I>lsof</I>
|
|
|
|
FAQ (The <B>FAQ</B> section gives its location.)
|
|
for more information.
|
|
<A NAME="lbAJ"> </A>
|
|
<H2>OUTPUT FOR OTHER PROGRAMS</H2>
|
|
|
|
When the
|
|
<B>-F</B>
|
|
|
|
option is specified,
|
|
<I>lsof</I>
|
|
|
|
produces output that is suitable for processing by another program - e.g, an
|
|
<I>awk</I>
|
|
|
|
or
|
|
<I>Perl</I>
|
|
|
|
script, or a C program.
|
|
<P>
|
|
|
|
Each unit of information is output in a field that is identified
|
|
with a leading character and terminated by a NL (012) (or a NUL
|
|
(000) if the 0 (zero) field identifier character is specified.)
|
|
The data of the field follows immediately after the field identification
|
|
character and extends to the field terminator.
|
|
<P>
|
|
|
|
It is possible to think of field output as process and file sets.
|
|
A process set begins with a field whose identifier is `p' (for
|
|
process IDentifier (PID)).
|
|
It extends to the beginning of the next PID field or the beginning
|
|
of the first file set of the process, whichever comes first.
|
|
Included in the process set are fields that identify the command,
|
|
the process group IDentification (PGID) number, the task (thread)
|
|
ID (TID), and the user ID (UID) number or login name.
|
|
<P>
|
|
|
|
A file set begins with a field whose identifier is `f' (for
|
|
file descriptor).
|
|
It is followed by lines that describe the file's access mode,
|
|
lock state, type, device, size, offset, inode, protocol, name
|
|
and stream module names.
|
|
It extends to the beginning of the next file or process set,
|
|
whichever comes first.
|
|
<P>
|
|
|
|
When the NUL (000) field terminator has been selected with the
|
|
0 (zero) field identifier character,
|
|
<I>lsof</I>
|
|
|
|
ends each process and file set with a NL (012) character.
|
|
<P>
|
|
|
|
<I>Lsof</I>
|
|
|
|
always produces one field, the PID (`p') field.
|
|
All other fields may be declared optionally in the field identifier
|
|
character list that follows the
|
|
<B>-F</B>
|
|
|
|
option.
|
|
When a field selection character identifies an item
|
|
<I>lsof</I>
|
|
|
|
does not normally list - e.g., PPID, selected with
|
|
<B>-R</B> -
|
|
|
|
specification of the field character - e.g., ``<B>-FR</B>'' -
|
|
also selects the listing of the item.
|
|
<P>
|
|
|
|
It is entirely possible to select a set of fields that cannot
|
|
easily be parsed - e.g., if the field descriptor field is not
|
|
selected, it may be difficult to identify file sets.
|
|
To help you avoid this difficulty,
|
|
<I>lsof</I>
|
|
|
|
supports the
|
|
<B>-F</B>
|
|
|
|
option; it selects the output of all fields with NL terminators
|
|
(the
|
|
<B>-F0</B>
|
|
|
|
option pair selects the output of all fields with NUL terminators).
|
|
For compatibility reasons neither
|
|
<B>-F</B>
|
|
|
|
nor
|
|
<B>-F0</B>
|
|
|
|
select the raw device field.
|
|
<P>
|
|
|
|
These are the fields that
|
|
<I>lsof</I>
|
|
|
|
will produce.
|
|
The single character listed first is the field identifier.
|
|
<P>
|
|
|
|
<PRE>
|
|
a file access mode
|
|
c process command name (all characters from proc or
|
|
user structure)
|
|
C file structure share count
|
|
d file's device character code
|
|
D file's major/minor device number (0x<hexadecimal>)
|
|
f file descriptor (always selected)
|
|
F file structure address (0x<hexadecimal>)
|
|
G file flaGs (0x<hexadecimal>; names if <B>+fg</B> follows)
|
|
g process group ID
|
|
i file's inode number
|
|
K tasK ID
|
|
k link count
|
|
l file's lock status
|
|
L process login name
|
|
m marker between repeated output
|
|
M the task comMand name
|
|
n file name, comment, Internet address
|
|
N node identifier (ox<hexadecimal>
|
|
o file's offset (decimal)
|
|
p process ID (always selected)
|
|
P protocol name
|
|
r raw device number (0x<hexadecimal>)
|
|
R parent process ID
|
|
s file's size (decimal)
|
|
S file's stream identification
|
|
t file's type
|
|
T TCP/TPI information, identified by prefixes (the
|
|
`=' is part of the prefix):
|
|
QR=<read queue size>
|
|
QS=<send queue size>
|
|
SO=<socket options and values> (not all dialects)
|
|
SS=<socket states> (not all dialects)
|
|
ST=<connection state>
|
|
TF=<TCP flags and values> (not all dialects)
|
|
WR=<window read size> (not all dialects)
|
|
WW=<window write size> (not all dialects)
|
|
(TCP/TPI information isn't reported for all supported
|
|
UNIX dialects. The <B>-h</B> or <B>-?</B> help output for the
|
|
<B>-T</B> option will show what TCP/TPI reporting can be
|
|
requested.)
|
|
u process user ID
|
|
z Solaris 10 and higher zone name
|
|
Z SELinux security context (inhibited when SELinux is disabled)
|
|
0 use NUL field terminator character in place of NL
|
|
1-9 dialect-specific field identifiers (The output
|
|
of <B>-F?</B> identifies the information to be found
|
|
in dialect-specific fields.)
|
|
</PRE>
|
|
|
|
<P>
|
|
|
|
You can get on-line help information on these characters and their
|
|
descriptions by specifying the
|
|
<B>-F?</B>
|
|
|
|
option pair.
|
|
(Escape the `?' character as your shell requires.)
|
|
Additional information on field content can be found in the
|
|
<B>OUTPUT</B>
|
|
|
|
section.
|
|
<P>
|
|
|
|
As an example, ``<B>-F pcfn</B>'' will select the process ID (`p'),
|
|
command name (`c'), file descriptor (`f') and file name (`n')
|
|
fields with an NL field terminator character; ``<B>-F pcfn0</B>''
|
|
selects the same output with a NUL (000) field terminator character.
|
|
<P>
|
|
|
|
<I>Lsof</I>
|
|
|
|
doesn't produce all fields for every process or file set, only
|
|
those that are available.
|
|
Some fields are mutually exclusive: file device characters and
|
|
file major/minor device numbers; file inode number and protocol
|
|
name; file name and stream identification; file size and offset.
|
|
One or the other member of these mutually exclusive sets will appear
|
|
in field output, but not both.
|
|
<P>
|
|
|
|
Normally
|
|
<I>lsof</I>
|
|
|
|
ends each field with a NL (012) character.
|
|
The
|
|
0 (zero) field identifier character may be specified to change the
|
|
field terminator character
|
|
to a NUL (000).
|
|
A NUL terminator may be easier to process with
|
|
<I>xargs (1),</I>
|
|
|
|
for example, or with programs whose quoting mechanisms may not
|
|
easily cope with the range of characters in the field output.
|
|
When the NUL field terminator is in use,
|
|
<I>lsof</I>
|
|
|
|
ends each process and file set with a NL (012).
|
|
<P>
|
|
|
|
Three aids to producing programs that can process
|
|
<I>lsof</I>
|
|
|
|
field output are included in the
|
|
<I>lsof</I>
|
|
|
|
distribution.
|
|
The first is a C header file,
|
|
<I>lsof_fields.h</I>,
|
|
|
|
that contains symbols for the field identification characters, indexes for
|
|
storing them in a table, and explanation strings that may be compiled into
|
|
programs.
|
|
<I>Lsof</I>
|
|
|
|
uses this header file.
|
|
<P>
|
|
|
|
The second aid is a set of sample scripts that process field output,
|
|
written in
|
|
<I>awk</I>,
|
|
|
|
<I>Perl</I>
|
|
|
|
4, and
|
|
<I>Perl</I>
|
|
|
|
5.
|
|
They're located in the
|
|
<I>scripts</I>
|
|
|
|
subdirectory of the
|
|
<I>lsof</I>
|
|
|
|
distribution.
|
|
<P>
|
|
|
|
The third aid is the C library used for the
|
|
<I>lsof</I>
|
|
|
|
test suite.
|
|
The test suite is written in C and uses field output to validate
|
|
the correct operation of
|
|
<I>lsof</I>.
|
|
|
|
The library can be found in the
|
|
<I>tests/LTlib.c</I>
|
|
|
|
file of the
|
|
<I>lsof</I>
|
|
|
|
distribution.
|
|
The library uses the first aid, the
|
|
<I>lsof_fields.h</I>
|
|
|
|
header file.
|
|
<A NAME="lbAK"> </A>
|
|
<H2>BLOCKS AND TIMEOUTS</H2>
|
|
|
|
<I>Lsof</I>
|
|
|
|
can be blocked by some kernel functions that it uses -
|
|
<I><A HREF="/cgi-bin/man/man2html?2+lstat">lstat</A></I>(2),
|
|
|
|
<I><A HREF="/cgi-bin/man/man2html?2+readlink">readlink</A></I>(2),
|
|
|
|
and
|
|
<I><A HREF="/cgi-bin/man/man2html?2+stat">stat</A></I>(2).
|
|
|
|
These functions are stalled in the kernel, for example, when the
|
|
hosts where mounted NFS file systems reside become inaccessible.
|
|
<P>
|
|
|
|
<I>Lsof</I>
|
|
|
|
attempts to break these blocks with timers and child processes,
|
|
but the techniques are not wholly reliable.
|
|
When
|
|
<I>lsof</I>
|
|
|
|
does manage to break a block, it will report the break with an error
|
|
message.
|
|
The messages may be suppressed with the
|
|
<B>-t</B>
|
|
|
|
and
|
|
<B>-w</B>
|
|
|
|
options.
|
|
<P>
|
|
|
|
The default timeout value may be displayed with the
|
|
<B>-h</B>
|
|
|
|
or
|
|
<B>-?</B>
|
|
|
|
option, and it may be changed with the
|
|
<B>-S</B><I> [t]</I>
|
|
|
|
option.
|
|
The minimum for
|
|
<I>t</I>
|
|
|
|
is two seconds, but you should avoid small values, since slow system
|
|
responsiveness can cause short timeouts to expire unexpectedly and
|
|
perhaps stop
|
|
<I>lsof</I>
|
|
|
|
before it can produce any output.
|
|
<P>
|
|
|
|
When
|
|
<I>lsof</I>
|
|
|
|
has to break a block during its access of mounted file system
|
|
information, it normally continues, although with less information
|
|
available to display about open files.
|
|
<P>
|
|
|
|
<I>Lsof</I>
|
|
|
|
can also be directed to avoid the protection of timers and child processes
|
|
when using the kernel functions that might block by specifying the
|
|
<B>-O</B>
|
|
|
|
option.
|
|
While this will allow
|
|
<I>lsof</I>
|
|
|
|
to start up with less overhead, it exposes
|
|
<I>lsof</I>
|
|
|
|
completely to the kernel situations that might block it.
|
|
Use this option cautiously.
|
|
<A NAME="lbAL"> </A>
|
|
<H2>AVOIDING KERNEL BLOCKS</H2>
|
|
|
|
<P>
|
|
|
|
You can use the
|
|
<B>-b</B>
|
|
|
|
option to tell
|
|
<I>lsof</I>
|
|
|
|
to avoid using kernel functions that would block.
|
|
Some cautions apply.
|
|
<P>
|
|
|
|
First, using this option usually requires that your system supply
|
|
alternate device numbers in place of the device numbers that
|
|
<I>lsof</I>
|
|
|
|
would normally obtain with the
|
|
<I><A HREF="/cgi-bin/man/man2html?2+lstat">lstat</A></I>(2)
|
|
|
|
and
|
|
<I><A HREF="/cgi-bin/man/man2html?2+stat">stat</A></I>(2)
|
|
|
|
kernel functions.
|
|
See the
|
|
<B>ALTERNATE DEVICE NUMBERS</B>
|
|
|
|
section for more information on alternate device numbers.
|
|
<P>
|
|
|
|
Second, you can't specify
|
|
<I>names</I>
|
|
|
|
for
|
|
<I>lsof</I>
|
|
|
|
to locate unless they're file system names.
|
|
This is because
|
|
<I>lsof</I>
|
|
|
|
needs to know the device and inode numbers of files listed with
|
|
<I>names</I>
|
|
|
|
in the
|
|
<I>lsof</I>
|
|
|
|
options, and the
|
|
<B>-b</B>
|
|
|
|
option prevents
|
|
<I>lsof</I>
|
|
|
|
from obtaining them.
|
|
Moreover, since
|
|
<I>lsof</I>
|
|
|
|
only has device numbers for the file systems that have alternates,
|
|
its ability to locate files on file systems depends completely on the
|
|
availability and accuracy of the alternates.
|
|
If no alternates are available, or if they're incorrect,
|
|
<I>lsof</I>
|
|
|
|
won't be able to locate files on the named file systems.
|
|
<P>
|
|
|
|
Third, if the names of your file system directories that
|
|
<I>lsof</I>
|
|
|
|
obtains from your system's mount table are symbolic links,
|
|
<I>lsof</I>
|
|
|
|
won't be able to resolve the links.
|
|
This is because the
|
|
<B>-b</B>
|
|
|
|
option causes
|
|
<I>lsof</I>
|
|
|
|
to avoid the kernel
|
|
<I><A HREF="/cgi-bin/man/man2html?2+readlink">readlink</A></I>(2)
|
|
|
|
function it uses to resolve symbolic links.
|
|
<P>
|
|
|
|
Finally, using the
|
|
<B>-b</B>
|
|
|
|
option causes
|
|
<I>lsof</I>
|
|
|
|
to issue warning messages when it needs to use the kernel functions
|
|
that the
|
|
<B>-b</B>
|
|
|
|
option directs it to avoid.
|
|
You can suppress these messages by specifying the
|
|
<B>-w</B>
|
|
|
|
option, but if you do, you won't see the alternate device numbers
|
|
reported in the warning messages.
|
|
<A NAME="lbAM"> </A>
|
|
<H2>ALTERNATE DEVICE NUMBERS</H2>
|
|
|
|
<P>
|
|
|
|
On some dialects, when
|
|
<I>lsof</I>
|
|
|
|
has to break a block because it can't get information about a
|
|
mounted file system via the
|
|
<I><A HREF="/cgi-bin/man/man2html?2+lstat">lstat</A></I>(2)
|
|
|
|
and
|
|
<I><A HREF="/cgi-bin/man/man2html?2+stat">stat</A></I>(2)
|
|
|
|
kernel functions, or because you specified the
|
|
<B>-b</B>
|
|
|
|
option,
|
|
<I>lsof</I>
|
|
|
|
can obtain some of the information it needs - the device number and
|
|
possibly the file system type - from the system mount table.
|
|
When that is possible,
|
|
<I>lsof</I>
|
|
|
|
will report the device number it obtained.
|
|
(You can suppress the report by specifying the
|
|
<B>-w</B>
|
|
|
|
option.)
|
|
<P>
|
|
|
|
You can assist this process if your mount table is supported with an
|
|
<I>/etc/mtab</I>
|
|
|
|
or
|
|
<I>/etc/mnttab</I>
|
|
|
|
file that contains an options field by adding a ``dev=xxxx'' field for
|
|
mount points that do not have one in their options strings.
|
|
Note: you must be able to edit the file - i.e., some mount tables
|
|
like recent Solaris /etc/mnttab or Linux /proc/mounts are read-only
|
|
and can't be modified.
|
|
<P>
|
|
|
|
You may also be able to supply device numbers using the
|
|
<B>+m</B>
|
|
|
|
and
|
|
<B>+m</B><I> m</I>
|
|
|
|
options, provided they are supported by your dialect.
|
|
Check the output of
|
|
<I>lsof's</I>
|
|
|
|
<B>-h</B>
|
|
|
|
or
|
|
<B>-?</B>
|
|
|
|
options to see if the
|
|
<B>+m</B>
|
|
|
|
and
|
|
<B>+m</B><I> m</I>
|
|
|
|
options are available.
|
|
<P>
|
|
|
|
The ``xxxx'' portion of the field is the hexadecimal value
|
|
of the file system's device number.
|
|
(Consult the
|
|
<I>st_dev</I>
|
|
|
|
field of the output of the
|
|
<I><A HREF="/cgi-bin/man/man2html?2+lstat">lstat</A></I>(2)
|
|
|
|
and
|
|
<I><A HREF="/cgi-bin/man/man2html?2+stat">stat</A></I>(2)
|
|
|
|
functions for the appropriate values for your file systems.)
|
|
Here's an example from a Sun Solaris 2.6
|
|
<I>/etc/mnttab</I>
|
|
|
|
for a file system remotely mounted via NFS:
|
|
<P>
|
|
|
|
<PRE>
|
|
nfs ignore,noquota,dev=2a40001
|
|
</PRE>
|
|
|
|
<P>
|
|
|
|
There's an advantage to having ``dev=xxxx'' entries in your mount
|
|
table file, especially for file systems that are mounted from remote
|
|
NFS servers.
|
|
When a remote server crashes and you want to identify its users by running
|
|
<I>lsof</I>
|
|
|
|
on one of its clients,
|
|
<I>lsof</I>
|
|
|
|
probably won't be able to get output from the
|
|
<I><A HREF="/cgi-bin/man/man2html?2+lstat">lstat</A></I>(2)
|
|
|
|
and
|
|
<I><A HREF="/cgi-bin/man/man2html?2+stat">stat</A></I>(2)
|
|
|
|
functions for the file system.
|
|
If it can obtain the file system's device number from the mount table,
|
|
it will be able to display the files open on the crashed NFS server.
|
|
<P>
|
|
|
|
Some dialects that do not use an ASCII
|
|
<I>/etc/mtab</I>
|
|
|
|
or
|
|
<I>/etc/mnttab</I>
|
|
|
|
file for the mount table may still provide an alternative device number
|
|
in their internal mount tables.
|
|
This includes AIX, Apple Darwin, FreeBSD, NetBSD, OpenBSD, and Tru64 UNIX.
|
|
<I>Lsof</I>
|
|
|
|
knows how to obtain the alternative device number for these dialects
|
|
and uses it when its attempt to
|
|
<I><A HREF="/cgi-bin/man/man2html?2+lstat">lstat</A></I>(2)
|
|
|
|
or
|
|
<I><A HREF="/cgi-bin/man/man2html?2+stat">stat</A></I>(2)
|
|
|
|
the file system is blocked.
|
|
<P>
|
|
|
|
If you're not sure your dialect supplies alternate device numbers
|
|
for file systems from its mount table, use this
|
|
<I>lsof</I>
|
|
|
|
incantation to see if it reports any alternate device numbers:
|
|
<P>
|
|
|
|
<DL COMPACT>
|
|
<DT id="360"><DD>
|
|
lsof -b
|
|
</DL>
|
|
<P>
|
|
|
|
Look for standard error file warning messages that
|
|
begin ``assuming "dev=xxxx" from ...''.
|
|
<A NAME="lbAN"> </A>
|
|
<H2>KERNEL NAME CACHE</H2>
|
|
|
|
<P>
|
|
|
|
<I>Lsof</I>
|
|
|
|
is able to examine the kernel's name cache or use other kernel
|
|
facilities (e.g., the ADVFS 4.x tag_to_path() function under
|
|
Tru64 UNIX) on some dialects for most file system types,
|
|
excluding AFS, and extract recently used path name components from it.
|
|
(AFS file system path lookups don't use the kernel's name cache; some
|
|
Solaris VxFS file system operations apparently don't use it, either.)
|
|
<P>
|
|
|
|
<I>Lsof</I>
|
|
|
|
reports the complete paths it finds in the NAME column.
|
|
If
|
|
<I>lsof</I>
|
|
|
|
can't report all components in a path, it reports in the NAME column
|
|
the file system name, followed by a space, two `-' characters, another
|
|
space, and the name components it has located, separated by
|
|
the `/' character.
|
|
<P>
|
|
|
|
When
|
|
<I>lsof</I>
|
|
|
|
is run in repeat mode - i.e., with the
|
|
<B>-r</B>
|
|
|
|
option specified - the extent to which it can report path name
|
|
components for the same file may vary from cycle to cycle.
|
|
That's because other running processes can cause the kernel to
|
|
remove entries from its name cache and replace them with others.
|
|
<P>
|
|
|
|
<I>Lsof's</I>
|
|
|
|
use of the kernel name cache to identify the paths of files
|
|
can lead it to report incorrect components under some circumstances.
|
|
This can happen when the kernel name cache uses device and node
|
|
number as a key (e.g., SCO OpenServer) and a key on a rapidly
|
|
changing file system is reused.
|
|
If the UNIX dialect's kernel doesn't purge the name cache entry for
|
|
a file when it is unlinked,
|
|
<I>lsof</I>
|
|
|
|
may find a reference to the wrong entry in the cache.
|
|
The
|
|
<I>lsof</I>
|
|
|
|
FAQ (The <B>FAQ</B> section gives its location.)
|
|
has more information on this situation.
|
|
<P>
|
|
|
|
<I>Lsof</I>
|
|
|
|
can report path name components for these dialects:
|
|
<P>
|
|
|
|
<PRE>
|
|
FreeBSD
|
|
HP-UX
|
|
Linux
|
|
NetBSD
|
|
NEXTSTEP
|
|
OpenBSD
|
|
OPENSTEP
|
|
SCO OpenServer
|
|
SCO|Caldera UnixWare
|
|
Solaris
|
|
Tru64 UNIX
|
|
</PRE>
|
|
|
|
<P>
|
|
|
|
<I>Lsof</I>
|
|
|
|
can't report path name components for these dialects:
|
|
<P>
|
|
|
|
<PRE>
|
|
AIX
|
|
</PRE>
|
|
|
|
<P>
|
|
|
|
If you want to know why
|
|
<I>lsof</I>
|
|
|
|
can't report path name components for some dialects, see the
|
|
<I>lsof</I>
|
|
|
|
FAQ (The <B>FAQ</B> section gives its location.)
|
|
<A NAME="lbAO"> </A>
|
|
<H2>DEVICE CACHE FILE</H2>
|
|
|
|
<P>
|
|
|
|
Examining all members of the
|
|
<I>/dev</I>
|
|
|
|
(or
|
|
<I>/devices</I>)
|
|
|
|
node tree with
|
|
<I><A HREF="/cgi-bin/man/man2html?2+stat">stat</A></I>(2)
|
|
|
|
functions can be time consuming.
|
|
What's more, the information that
|
|
<I>lsof</I>
|
|
|
|
needs - device number, inode number, and path - rarely changes.
|
|
<P>
|
|
|
|
Consequently,
|
|
<I>lsof</I>
|
|
|
|
normally maintains an ASCII text file of cached
|
|
<I>/dev</I>
|
|
|
|
(or
|
|
<I>/devices</I>)
|
|
|
|
information (exception: the /proc-based Linux
|
|
<I>lsof</I>
|
|
|
|
where it's not needed.)
|
|
The local system administrator who builds
|
|
<I>lsof</I>
|
|
|
|
can control the way the device cache file path is formed, selecting
|
|
from these options:
|
|
<P>
|
|
|
|
<PRE>
|
|
Path from the <B>-D</B> option;
|
|
Path from an environment variable;
|
|
System-wide path;
|
|
Personal path (the default);
|
|
Personal path, modified by an environment variable.
|
|
</PRE>
|
|
|
|
<P>
|
|
|
|
Consult the output of the
|
|
<B>-h</B>,
|
|
|
|
<B>-D? ,</B>
|
|
|
|
or
|
|
<B>-?</B>
|
|
|
|
help options for the current state of device cache support.
|
|
The help output lists the default read-mode device cache file path that
|
|
is in effect for the current invocation of
|
|
<I>lsof</I>.
|
|
|
|
The
|
|
<B>-D?</B>
|
|
|
|
option output lists the read-only and write device cache file paths,
|
|
the names of any applicable environment variables, and the personal
|
|
device cache path format.
|
|
<P>
|
|
|
|
<I>Lsof</I>
|
|
|
|
can detect that the current device cache file has been accidentally
|
|
or maliciously modified by integrity checks, including the computation
|
|
and verification of a sixteen bit Cyclic Redundancy Check (CRC) sum on
|
|
the file's contents.
|
|
When
|
|
<I>lsof</I>
|
|
|
|
senses something wrong with the file, it issues a warning and attempts
|
|
to remove the current cache file and create a new copy, but only to
|
|
a path that the process can legitimately write.
|
|
<P>
|
|
|
|
The path from which a
|
|
<I>lsof</I>
|
|
|
|
process may attempt to read a device cache file may not be the same
|
|
as the path to which it can legitimately write.
|
|
Thus when
|
|
<I>lsof</I>
|
|
|
|
senses that it needs to update the device cache file, it may
|
|
choose a different path for writing it from the path from which
|
|
it read an incorrect or outdated version.
|
|
<P>
|
|
|
|
If available, the
|
|
<B>-Dr</B>
|
|
|
|
option will inhibit the writing of a new device cache file.
|
|
(It's always available when specified without a path name argument.)
|
|
<P>
|
|
|
|
When a new device is added to the system, the device cache file may
|
|
need to be recreated.
|
|
Since
|
|
<I>lsof</I>
|
|
|
|
compares the mtime of the device cache file with the mtime and ctime
|
|
of the
|
|
<I>/dev</I>
|
|
|
|
(or
|
|
<I>/devices</I>)
|
|
|
|
directory, it usually detects that a new device has been added;
|
|
in that case
|
|
<I>lsof</I>
|
|
|
|
issues a warning message and attempts to rebuild the device cache file.
|
|
<P>
|
|
|
|
Whenever
|
|
<I>lsof</I>
|
|
|
|
writes a device cache file, it sets its ownership to the real UID
|
|
of the executing process, and its permission modes to 0600, this
|
|
restricting its reading and writing to the file's owner.
|
|
<A NAME="lbAP"> </A>
|
|
<H2>LSOF PERMISSIONS THAT AFFECT DEVICE CACHE FILE ACCESS</H2>
|
|
|
|
<P>
|
|
|
|
Two permissions of the
|
|
<I>lsof</I>
|
|
|
|
executable affect its ability to access device cache files.
|
|
The permissions are set by the local system administrator when
|
|
<I>lsof</I>
|
|
|
|
is installed.
|
|
<P>
|
|
|
|
The first and rarer permission is setuid-root.
|
|
It comes into effect when
|
|
<I>lsof</I>
|
|
|
|
is executed; its effective UID is then
|
|
root, while its real (i.e., that of the logged-on user) UID is not.
|
|
The
|
|
<I>lsof</I>
|
|
|
|
distribution recommends that versions for these dialects run setuid-root.
|
|
<P>
|
|
|
|
<PRE>
|
|
HP-UX 11.11 and 11.23
|
|
Linux
|
|
</PRE>
|
|
|
|
<P>
|
|
|
|
The second and more common permission is setgid.
|
|
It comes into effect when the effective group IDentification number (GID)
|
|
of the
|
|
<I>lsof</I>
|
|
|
|
process is set to one that can access kernel memory devices -
|
|
e.g., ``kmem'', ``sys'', or ``system''.
|
|
<P>
|
|
|
|
An
|
|
<I>lsof</I>
|
|
|
|
process that has setgid permission usually surrenders the permission
|
|
after it has accessed the kernel memory devices.
|
|
When it does that,
|
|
<I>lsof</I>
|
|
|
|
can allow more liberal device cache path formations.
|
|
The
|
|
<I>lsof</I>
|
|
|
|
distribution recommends that versions for these dialects run setgid
|
|
and be allowed to surrender setgid permission.
|
|
<P>
|
|
|
|
<PRE>
|
|
AIX 5.[12] and 5.3-ML1
|
|
Apple Darwin 7.x Power Macintosh systems
|
|
FreeBSD 4.x, 4.1x, 5.x and [6789].x for x86-based systems
|
|
FreeBSD 5.x, [6789].x and 1[012].8for Alpha, AMD64 and Sparc64
|
|
based systems
|
|
HP-UX 11.00
|
|
NetBSD 1.[456], 2.x and 3.x for Alpha, x86, and SPARC-based
|
|
systems
|
|
NEXTSTEP 3.[13] for NEXTSTEP architectures
|
|
OpenBSD 2.[89] and 3.[0-9] for x86-based systems
|
|
OPENSTEP 4.x
|
|
SCO OpenServer Release 5.0.6 for x86-based systems
|
|
SCO|Caldera UnixWare 7.1.4 for x86-based systems
|
|
Solaris 2.6, 8, 9 and 10
|
|
Tru64 UNIX 5.1
|
|
</PRE>
|
|
|
|
<P>
|
|
|
|
(Note:
|
|
<I>lsof</I>
|
|
|
|
for AIX 5L and above needs setuid-root permission if its
|
|
<B>-X</B>
|
|
|
|
option is used.)
|
|
<P>
|
|
|
|
<I>Lsof</I>
|
|
|
|
for these dialects does not support a device cache, so the permissions
|
|
given to the executable don't apply to the device cache file.
|
|
<P>
|
|
|
|
<PRE>
|
|
Linux
|
|
</PRE>
|
|
|
|
<A NAME="lbAQ"> </A>
|
|
<H2>DEVICE CACHE FILE PATH FROM THE -D OPTION</H2>
|
|
|
|
<P>
|
|
|
|
The
|
|
<B>-D</B>
|
|
|
|
option provides limited means for specifying the device cache file path.
|
|
Its
|
|
<B>?</B>
|
|
|
|
function will report the read-only and write device cache file paths that
|
|
<I>lsof</I>
|
|
|
|
will use.
|
|
<P>
|
|
|
|
When the
|
|
<B>-D</B>
|
|
|
|
<B>b</B>,
|
|
|
|
<B>r</B>,
|
|
|
|
and
|
|
<B>u</B>
|
|
|
|
functions are available, you can use them to request that the cache file be
|
|
built in a specific location (<B>b</B>[<I>path</I>]);
|
|
read but not rebuilt (<B>r</B>[<I>path</I>]);
|
|
or read and rebuilt (<B>u</B>[<I>path</I>]).
|
|
The
|
|
<B>b</B>,
|
|
|
|
<B>r</B>,
|
|
|
|
and
|
|
<B>u</B>
|
|
|
|
functions are restricted under some conditions.
|
|
They are restricted when the
|
|
<I>lsof</I>
|
|
|
|
process is setuid-root.
|
|
The path specified with the
|
|
<B>r</B>
|
|
|
|
function is always read-only, even
|
|
when it is available.
|
|
<P>
|
|
|
|
The
|
|
<B>b</B>,
|
|
|
|
<B>r</B>,
|
|
|
|
and
|
|
<B>u</B>
|
|
|
|
functions are also restricted when the
|
|
<I>lsof</I>
|
|
|
|
process runs setgid and
|
|
<I>lsof</I>
|
|
|
|
doesn't surrender the setgid permission.
|
|
(See the
|
|
<B>LSOF PERMISSIONS THAT AFFECT DEVICE CACHE FILE ACCESS</B>
|
|
|
|
section for a list of implementations that normally don't surrender
|
|
their setgid permission.)
|
|
<P>
|
|
|
|
A further
|
|
<B>-D</B>
|
|
|
|
function,
|
|
<B>i</B>
|
|
|
|
(for ignore), is always available.
|
|
<P>
|
|
|
|
When available, the
|
|
<B>b</B>
|
|
|
|
function tells
|
|
<I>lsof</I>
|
|
|
|
to read device information from the kernel with the
|
|
<I><A HREF="/cgi-bin/man/man2html?2+stat">stat</A></I>(2)
|
|
|
|
function and build a device cache file at the indicated path.
|
|
<P>
|
|
|
|
When available, the
|
|
<B>r</B>
|
|
|
|
function tells
|
|
<I>lsof</I>
|
|
|
|
to read the device cache file, but not update it.
|
|
When a path argument accompanies
|
|
<B>-Dr</B>,
|
|
|
|
it names the device cache file path.
|
|
The
|
|
<B>r</B>
|
|
|
|
function is always available when it is specified without a
|
|
path name argument.
|
|
If
|
|
<I>lsof</I>
|
|
|
|
is not running setuid-root and surrenders its setgid permission,
|
|
a path name argument may accompany the
|
|
<B>r</B>
|
|
|
|
function.
|
|
<P>
|
|
|
|
When available, the
|
|
<B>u</B>
|
|
|
|
function tells
|
|
<I>lsof</I>
|
|
|
|
to attempt to read and use the device cache file.
|
|
If it can't read the file, or if it finds the contents of the
|
|
file incorrect or outdated, it will read information from the kernel,
|
|
and attempt to write an updated version of the device cache file,
|
|
but only to a path it considers legitimate for the
|
|
<I>lsof</I>
|
|
|
|
process effective and real UIDs.
|
|
<A NAME="lbAR"> </A>
|
|
<H2>DEVICE CACHE PATH FROM AN ENVIRONMENT VARIABLE</H2>
|
|
|
|
<P>
|
|
|
|
<I>Lsof's</I>
|
|
|
|
second choice for the device cache file is the contents of the
|
|
LSOFDEVCACHE environment variable.
|
|
It avoids this choice if the
|
|
<I>lsof</I>
|
|
|
|
process is setuid-root, or the real UID of the process is root.
|
|
<P>
|
|
|
|
A further restriction applies to a device cache file path taken from
|
|
the LSOFDEVCACHE environment variable:
|
|
<I>lsof</I>
|
|
|
|
will not write a device cache file to the path if the
|
|
<I>lsof</I>
|
|
|
|
process doesn't surrender its setgid permission.
|
|
(See the
|
|
<B>LSOF PERMISSIONS THAT AFFECT DEVICE CACHE FILE ACCESS</B>
|
|
|
|
section for information on implementations that don't surrender
|
|
their setgid permission.)
|
|
<P>
|
|
|
|
The local system administrator can disable the use of the LSOFDEVCACHE
|
|
environment variable or change its name when building
|
|
<I>lsof</I>.
|
|
|
|
Consult the output of
|
|
<B>-D?</B>
|
|
|
|
for the environment variable's name.
|
|
<A NAME="lbAS"> </A>
|
|
<H2>SYSTEM-WIDE DEVICE CACHE PATH</H2>
|
|
|
|
<P>
|
|
|
|
The local system administrator may choose to have a system-wide
|
|
device cache file when building
|
|
<I>lsof</I>.
|
|
|
|
That file will generally be constructed by a special system administration
|
|
procedure when the system is booted or when the contents of
|
|
<I>/dev</I>
|
|
|
|
or
|
|
<I>/devices</I>)
|
|
|
|
changes.
|
|
If defined, it is
|
|
<I>lsof's</I>
|
|
|
|
third device cache file path choice.
|
|
<P>
|
|
|
|
You can tell that a system-wide device cache file is in effect
|
|
for your local installation by examining the
|
|
<I>lsof</I>
|
|
|
|
help option output - i.e., the output from the
|
|
<B>-h</B>
|
|
|
|
or
|
|
<B>-?</B>
|
|
|
|
option.
|
|
<P>
|
|
|
|
<I>Lsof</I>
|
|
|
|
will never write to the system-wide device cache file path by
|
|
default.
|
|
It must be explicitly named with a
|
|
<B>-D</B>
|
|
|
|
function in a root-owned procedure.
|
|
Once the file has been written, the procedure must change its permission
|
|
modes to 0644 (owner-read and owner-write, group-read, and other-read).
|
|
<A NAME="lbAT"> </A>
|
|
<H2>PERSONAL DEVICE CACHE PATH (DEFAULT)</H2>
|
|
|
|
<P>
|
|
|
|
The default device cache file path of the
|
|
<I>lsof</I>
|
|
|
|
distribution is one recorded in the home directory of the real UID
|
|
that executes
|
|
<I>lsof</I>.
|
|
|
|
Added to the home directory is a second path component of the form
|
|
<I>.lsof_hostname</I>.
|
|
|
|
<P>
|
|
|
|
This is
|
|
<I>lsof's</I>
|
|
|
|
fourth device cache file path choice, and is
|
|
usually the default.
|
|
If a system-wide device cache file path was defined when
|
|
<I>lsof</I>
|
|
|
|
was built,
|
|
this fourth choice will be applied when
|
|
<I>lsof</I>
|
|
|
|
can't find the system-wide device cache file.
|
|
This is the
|
|
<B>only</B>
|
|
|
|
time
|
|
<I>lsof</I>
|
|
|
|
uses two paths when reading the device cache file.
|
|
<P>
|
|
|
|
The
|
|
<I>hostname</I>
|
|
|
|
part of the second component is the base
|
|
name of the executing host, as returned by
|
|
<I><A HREF="/cgi-bin/man/man2html?2+gethostname">gethostname</A></I>(2).
|
|
|
|
The base name is defined to be the characters preceding the first `.'
|
|
in the
|
|
<I><A HREF="/cgi-bin/man/man2html?2+gethostname">gethostname</A></I>(2)
|
|
|
|
output, or all the
|
|
<I><A HREF="/cgi-bin/man/man2html?2+gethostname">gethostname</A></I>(2)
|
|
|
|
output if it contains no `.'.
|
|
<P>
|
|
|
|
The device cache file belongs to the user ID and is readable and
|
|
writable by the user ID alone - i.e., its modes are 0600.
|
|
Each distinct real user ID on a given host that executes
|
|
<I>lsof</I>
|
|
|
|
has a distinct device cache file.
|
|
The
|
|
<I>hostname</I>
|
|
|
|
part of the path distinguishes device cache files in an NFS-mounted
|
|
home directory into which device cache files are written from
|
|
several different hosts.
|
|
<P>
|
|
|
|
The personal device cache file path formed by this method represents
|
|
a device cache file that
|
|
<I>lsof</I>
|
|
|
|
will attempt to read, and will attempt to write should it not
|
|
exist or should its contents be incorrect or outdated.
|
|
<P>
|
|
|
|
The
|
|
<B>-Dr</B>
|
|
|
|
option without a path name argument will inhibit the writing of a new
|
|
device cache file.
|
|
<P>
|
|
|
|
The
|
|
<B>-D?</B>
|
|
|
|
option will list the format specification for constructing the
|
|
personal device cache file.
|
|
The conversions used in the format specification are described in the
|
|
<I>00DCACHE</I>
|
|
|
|
file of the
|
|
<I>lsof</I>
|
|
|
|
distribution.
|
|
<A NAME="lbAU"> </A>
|
|
<H2>MODIFIED PERSONAL DEVICE CACHE PATH</H2>
|
|
|
|
<P>
|
|
|
|
If this option is defined by the local system administrator when
|
|
<I>lsof</I>
|
|
|
|
is built, the LSOFPERSDCPATH environment variable contents may
|
|
be used to add a component of the personal device cache file path.
|
|
<P>
|
|
|
|
The LSOFPERSDCPATH variable contents are inserted in the path at the
|
|
place marked by the local system administrator with the ``%p''
|
|
conversion in the HASPERSDC format specification of the dialect's
|
|
<I>machine.h</I>
|
|
|
|
header file.
|
|
(It's placed right after the home directory in the default
|
|
<I>lsof</I>
|
|
|
|
distribution.)
|
|
<P>
|
|
|
|
Thus, for example, if LSOFPERSDCPATH contains ``LSOF'', the home
|
|
directory is ``/Homes/abe'', the host name is ``lsof.itap.purdue.edu'',
|
|
and the HASPERSDC format is the default (``%h/%p.lsof_%L''), the
|
|
modified personal device cache file path is:
|
|
<P>
|
|
|
|
<PRE>
|
|
/Homes/abe/LSOF/.lsof_vic
|
|
</PRE>
|
|
|
|
<P>
|
|
|
|
The LSOFPERSDCPATH environment variable is ignored when the
|
|
<I>lsof</I>
|
|
|
|
process is setuid-root or when the real UID of the process is root.
|
|
<P>
|
|
|
|
<I>Lsof</I>
|
|
|
|
will not write to a modified personal device cache file path if the
|
|
<I>lsof</I>
|
|
|
|
process doesn't surrender setgid permission.
|
|
(See the
|
|
<B>LSOF PERMISSIONS THAT AFFECT DEVICE CACHE FILE ACCESS</B>
|
|
|
|
section for a list of implementations that normally don't surrender
|
|
their setgid permission.)
|
|
<P>
|
|
|
|
If, for example, you want to create a sub-directory of personal
|
|
device cache file paths by using the LSOFPERSDCPATH environment
|
|
variable to name it, and
|
|
<I>lsof</I>
|
|
|
|
doesn't surrender its setgid permission, you will have to allow
|
|
<I>lsof</I>
|
|
|
|
to create device cache files at the standard personal path and
|
|
move them to your subdirectory with shell commands.
|
|
<P>
|
|
|
|
The local system administrator may: disable this option when
|
|
<I>lsof</I>
|
|
|
|
is built; change the name of the environment variable from
|
|
LSOFPERSDCPATH to something else; change the HASPERSDC
|
|
format to include the personal path component in another place;
|
|
or exclude the personal path component entirely.
|
|
Consult the output of the
|
|
<B>-D?</B>
|
|
|
|
option for the environment variable's name and the HASPERSDC
|
|
format specification.
|
|
<A NAME="lbAV"> </A>
|
|
<H2>DIAGNOSTICS</H2>
|
|
|
|
Errors are identified with messages on the standard error file.
|
|
<P>
|
|
|
|
<I>Lsof</I>
|
|
|
|
returns a one (1) if any error was detected, including the failure to
|
|
locate command names, file names, Internet addresses or files, login
|
|
names, NFS files, PIDs, PGIDs, or UIDs it was asked to list.
|
|
If the
|
|
<B>-V</B>
|
|
|
|
option is specified,
|
|
<I>lsof</I>
|
|
|
|
will indicate the search items it failed to list.
|
|
<P>
|
|
|
|
It returns a zero (0) if no errors were detected and if it was able to
|
|
list some information about all the specified search arguments.
|
|
<P>
|
|
|
|
<P>
|
|
|
|
When
|
|
<I>lsof</I>
|
|
|
|
cannot open access to
|
|
<I>/dev</I>
|
|
|
|
(or
|
|
<I>/devices</I>)
|
|
|
|
or one of its subdirectories, or get information on a file in them with
|
|
<I><A HREF="/cgi-bin/man/man2html?2+stat">stat</A></I>(2),
|
|
|
|
it issues a warning message and continues.
|
|
That
|
|
<I>lsof</I>
|
|
|
|
will issue warning messages about inaccessible files in
|
|
<I>/dev</I>
|
|
|
|
(or
|
|
<I>/devices</I>)
|
|
|
|
is indicated in its help output - requested with the
|
|
<B>-h</B>
|
|
|
|
or
|
|
>B -?
|
|
options - with the message:
|
|
<P>
|
|
|
|
<PRE>
|
|
Inaccessible /dev warnings are enabled.
|
|
</PRE>
|
|
|
|
<P>
|
|
|
|
The warning message may be suppressed with the
|
|
<B>-w</B>
|
|
|
|
option.
|
|
It may also have been suppressed by the system administrator when
|
|
<I>lsof</I>
|
|
|
|
was compiled by the setting of the WARNDEVACCESS definition.
|
|
In this case, the output from the help options will include the message:
|
|
<P>
|
|
|
|
<PRE>
|
|
Inaccessible /dev warnings are disabled.
|
|
</PRE>
|
|
|
|
<P>
|
|
|
|
Inaccessible device warning messages usually disappear after
|
|
<I>lsof</I>
|
|
|
|
has created a working device cache file.
|
|
<A NAME="lbAW"> </A>
|
|
<H2>EXAMPLES</H2>
|
|
|
|
For a more extensive set of examples, documented more fully, see the
|
|
<I>00QUICKSTART</I>
|
|
|
|
file of the
|
|
<I>lsof</I>
|
|
|
|
distribution.
|
|
<P>
|
|
|
|
To list all open files, use:
|
|
<DL COMPACT>
|
|
<DT id="361"><DD>
|
|
lsof
|
|
</DL>
|
|
<P>
|
|
|
|
To list all open Internet, x.25 (HP-UX), and UNIX domain files, use:
|
|
<DL COMPACT>
|
|
<DT id="362"><DD>
|
|
lsof -i -U
|
|
</DL>
|
|
<P>
|
|
|
|
To list all open IPv4 network files in use by the process whose PID is
|
|
1234, use:
|
|
<DL COMPACT>
|
|
<DT id="363"><DD>
|
|
lsof -i 4 -a -p 1234
|
|
</DL>
|
|
<P>
|
|
|
|
Presuming the UNIX dialect supports IPv6, to list only open IPv6
|
|
network files, use:
|
|
<DL COMPACT>
|
|
<DT id="364"><DD>
|
|
lsof -i 6
|
|
</DL>
|
|
<P>
|
|
|
|
To list all files using any protocol on ports 513, 514, or 515 of host
|
|
wonderland.cc.purdue.edu, use:
|
|
<DL COMPACT>
|
|
<DT id="365"><DD>
|
|
lsof -i @wonderland.cc.purdue.edu:513-515
|
|
</DL>
|
|
<P>
|
|
|
|
To list all files using any protocol on any port of mace.cc.purdue.edu
|
|
(cc.purdue.edu is the default domain), use:
|
|
<DL COMPACT>
|
|
<DT id="366"><DD>
|
|
lsof -i @mace
|
|
</DL>
|
|
<P>
|
|
|
|
To list all open files for login name ``abe'', or user ID 1234, or
|
|
process 456, or process 123, or process 789, use:
|
|
<DL COMPACT>
|
|
<DT id="367"><DD>
|
|
lsof -p 456,123,789 -u 1234,abe
|
|
</DL>
|
|
<P>
|
|
|
|
To list all open files on device /dev/hd4, use:
|
|
<DL COMPACT>
|
|
<DT id="368"><DD>
|
|
lsof /dev/hd4
|
|
</DL>
|
|
<P>
|
|
|
|
To find the process that has /u/abe/foo open, use:
|
|
<DL COMPACT>
|
|
<DT id="369"><DD>
|
|
lsof /u/abe/foo
|
|
</DL>
|
|
<P>
|
|
|
|
To send a SIGHUP to the processes that have /u/abe/bar open, use:
|
|
<DL COMPACT>
|
|
<DT id="370"><DD>
|
|
kill -HUP `lsof -t /u/abe/bar`
|
|
</DL>
|
|
<P>
|
|
|
|
To find any open file, including an open UNIX domain socket file,
|
|
with the name
|
|
<I>/dev/log</I>,
|
|
|
|
use:
|
|
<DL COMPACT>
|
|
<DT id="371"><DD>
|
|
lsof /dev/log
|
|
</DL>
|
|
<P>
|
|
|
|
To find processes with open files on the NFS file system named
|
|
<I>/nfs/mount/point</I>
|
|
|
|
whose server is inaccessible, and presuming your mount table supplies
|
|
the device number for
|
|
<I>/nfs/mount/point</I>,
|
|
|
|
use:
|
|
<DL COMPACT>
|
|
<DT id="372"><DD>
|
|
lsof -b /nfs/mount/point
|
|
</DL>
|
|
<P>
|
|
|
|
To do the preceding search with warning messages suppressed, use:
|
|
<DL COMPACT>
|
|
<DT id="373"><DD>
|
|
lsof -bw /nfs/mount/point
|
|
</DL>
|
|
<P>
|
|
|
|
To ignore the device cache file, use:
|
|
<DL COMPACT>
|
|
<DT id="374"><DD>
|
|
lsof -Di
|
|
</DL>
|
|
<P>
|
|
|
|
To obtain PID and command name field output for each process, file
|
|
descriptor, file device number, and file inode number for each file
|
|
of each process, use:
|
|
<DL COMPACT>
|
|
<DT id="375"><DD>
|
|
lsof -FpcfDi
|
|
</DL>
|
|
<P>
|
|
|
|
To list the files at descriptors 1 and 3 of every process running the
|
|
<I>lsof</I>
|
|
|
|
command for login ID ``abe'' every 10 seconds, use:
|
|
<DL COMPACT>
|
|
<DT id="376"><DD>
|
|
lsof -c lsof -a -d 1 -d 3 -u abe -r10
|
|
</DL>
|
|
<P>
|
|
|
|
To list the current working directory of processes running a command that
|
|
is exactly four characters long and has an 'o' or 'O' in character three,
|
|
use this regular expression form of the
|
|
<B>-c</B><I> c</I>
|
|
|
|
option:
|
|
<DL COMPACT>
|
|
<DT id="377"><DD>
|
|
lsof -c /^..o.$/i -a -d cwd
|
|
</DL>
|
|
<P>
|
|
|
|
To find an IP version 4 socket file by its associated numeric dot-form
|
|
address, use:
|
|
<DL COMPACT>
|
|
<DT id="378"><DD>
|
|
lsof <A HREF="mailto:-i@128.210.15.17">-i@128.210.15.17</A>
|
|
</DL>
|
|
<P>
|
|
|
|
To find an IP version 6 socket file (when the UNIX dialect supports
|
|
IPv6) by its associated numeric colon-form address, use:
|
|
<DL COMPACT>
|
|
<DT id="379"><DD>
|
|
lsof -i@[0:1:2:3:4:5:6:7]
|
|
</DL>
|
|
<P>
|
|
|
|
To find an IP version 6 socket file (when the UNIX dialect supports
|
|
IPv6) by an associated numeric colon-form address that has a run of
|
|
zeroes in it - e.g., the loop-back address - use:
|
|
<DL COMPACT>
|
|
<DT id="380"><DD>
|
|
lsof -i@[::1]
|
|
</DL>
|
|
<P>
|
|
|
|
To obtain a repeat mode marker line that contains the current time, use:
|
|
<DL COMPACT>
|
|
<DT id="381"><DD>
|
|
lsof -rm====%T====
|
|
</DL>
|
|
<P>
|
|
|
|
To add spaces to the previous marker line, use:
|
|
<DL COMPACT>
|
|
<DT id="382"><DD>
|
|
lsof -r "m==== %T ===="
|
|
</DL>
|
|
<A NAME="lbAX"> </A>
|
|
<H2>BUGS</H2>
|
|
|
|
Since
|
|
<I>lsof</I>
|
|
|
|
reads kernel memory in its search for open files, rapid changes in kernel
|
|
memory may produce unpredictable results.
|
|
<P>
|
|
|
|
When a file has multiple record locks, the lock status character
|
|
(following the file descriptor) is derived from a test of the first
|
|
lock structure, not from any combination of the individual record
|
|
locks that might be described by multiple lock structures.
|
|
<P>
|
|
|
|
<I>Lsof</I>
|
|
|
|
can't search for files with restrictive access permissions by
|
|
<I>name</I>
|
|
|
|
unless it is installed with root set-UID permission.
|
|
Otherwise it is limited to searching for files to which its user
|
|
or its set-GID group (if any) has access permission.
|
|
<P>
|
|
|
|
The display of the destination address of a raw socket (e.g., for
|
|
<I>ping</I>)
|
|
|
|
depends on the UNIX operating system.
|
|
Some dialects store the destination address in the raw socket's protocol
|
|
control block, some do not.
|
|
<P>
|
|
|
|
<I>Lsof</I>
|
|
|
|
can't always represent Solaris device numbers in the same way that
|
|
<I><A HREF="/cgi-bin/man/man2html?1+ls">ls</A></I>(1)
|
|
|
|
does.
|
|
For example, the major and minor device numbers that the
|
|
<I><A HREF="/cgi-bin/man/man2html?2+lstat">lstat</A></I>(2)
|
|
|
|
and
|
|
<I><A HREF="/cgi-bin/man/man2html?2+stat">stat</A></I>(2)
|
|
|
|
functions report for the directory on which CD-ROM files are mounted
|
|
(typically
|
|
<I>/cdrom</I>)
|
|
|
|
are not the same as the ones that it reports for the device on which
|
|
CD-ROM files are mounted (typically
|
|
<I>/dev/sr0</I>).
|
|
|
|
(<I>Lsof</I> reports the directory numbers.)
|
|
<P>
|
|
|
|
The support for
|
|
<I>/proc</I>
|
|
|
|
file systems is available only for BSD and Tru64 UNIX dialects, Linux, and
|
|
dialects derived from SYSV R4 - e.g., FreeBSD, NetBSD, OpenBSD, Solaris,
|
|
UnixWare.
|
|
<P>
|
|
|
|
Some
|
|
<I>/proc</I>
|
|
|
|
file items - device number, inode number, and file size -
|
|
are unavailable in some dialects.
|
|
Searching for files in a
|
|
<I>/proc</I>
|
|
|
|
file system may require that the full path name be specified.
|
|
<P>
|
|
|
|
No text (<B>txt</B>) file descriptors are displayed for Linux
|
|
processes.
|
|
All entries for files other than the current working directory,
|
|
the root directory, and numerical file descriptors are labeled
|
|
<B>mem</B>
|
|
|
|
descriptors.
|
|
<P>
|
|
|
|
<I>Lsof</I>
|
|
|
|
can't search for Tru64 UNIX named pipes by name, because their kernel
|
|
implementation of <A HREF="/cgi-bin/man/man2html?2+lstat">lstat</A>(2) returns an improper device number for a
|
|
named pipe.
|
|
<P>
|
|
|
|
<I>Lsof</I>
|
|
|
|
can't report fully or correctly on HP-UX 9.01, 10.20, and 11.00 locks
|
|
because of insufficient access to kernel data or errors in the
|
|
kernel data.
|
|
See the
|
|
<I>lsof</I>
|
|
|
|
FAQ (The <B>FAQ</B> section gives its location.)
|
|
for details.
|
|
<P>
|
|
|
|
The AIX SMT file type is a fabrication.
|
|
It's made up for file structures whose type (15) isn't defined in the AIX
|
|
<I>/usr/include/sys/file.h</I>
|
|
|
|
header file.
|
|
One way to create such file structures is to run X clients with the DISPLAY
|
|
variable set to ``:0.0''.
|
|
<P>
|
|
|
|
The
|
|
<B>+|-f</B><I>[cfn]</I>
|
|
|
|
option is not supported under /proc-based Linux
|
|
<I>lsof</I>,
|
|
|
|
because it doesn't read kernel structures from kernel memory.
|
|
<A NAME="lbAY"> </A>
|
|
<H2>ENVIRONMENT</H2>
|
|
|
|
<I>Lsof</I>
|
|
|
|
may access these environment variables.
|
|
<DL COMPACT>
|
|
<DT id="383">LANG<DD>
|
|
defines a language locale.
|
|
See
|
|
<I><A HREF="/cgi-bin/man/man2html?3+setlocale">setlocale</A></I>(3)
|
|
|
|
for the names of other variables that can be used in place
|
|
of LANG - e.g., LC_ALL, LC_TYPE, etc.
|
|
<DT id="384">LSOFDEVCACHE<DD>
|
|
defines the path to a device cache file.
|
|
See the
|
|
<B>DEVICE CACHE PATH FROM AN ENVIRONMENT VARIABLE</B>
|
|
|
|
section for more information.
|
|
<DT id="385">LSOFPERSDCPATH<DD>
|
|
defines the middle component of a modified personal device cache
|
|
file path.
|
|
See the
|
|
<B>MODIFIED PERSONAL DEVICE CACHE PATH</B>
|
|
|
|
section for more information.
|
|
</DL>
|
|
<A NAME="lbAZ"> </A>
|
|
<H2>FAQ</H2>
|
|
|
|
Frequently-asked questions and their answers (an FAQ) are
|
|
available in the
|
|
<I>00FAQ</I>
|
|
|
|
file of the
|
|
<I>lsof</I>
|
|
|
|
distribution.
|
|
<P>
|
|
|
|
That file is also available via anonymous ftp from
|
|
<I>lsof.itap.purdue.edu</I>
|
|
|
|
at
|
|
<I>pub/tools/unix/lsof</I>FAQ<I>.</I>
|
|
|
|
The URL is:
|
|
<DL COMPACT>
|
|
<DT id="386"><DD>
|
|
<A HREF="ftp://lsof.itap.purdue.edu/pub/tools/unix/lsof/FAQ">ftp://lsof.itap.purdue.edu/pub/tools/unix/lsof/FAQ</A>
|
|
</DL>
|
|
<A NAME="lbBA"> </A>
|
|
<H2>FILES</H2>
|
|
|
|
<DL COMPACT>
|
|
<DT id="387"><I>/dev/kmem</I>
|
|
|
|
<DD>
|
|
kernel virtual memory device
|
|
<DT id="388"><I>/dev/mem</I>
|
|
|
|
<DD>
|
|
physical memory device
|
|
<DT id="389"><I>/dev/swap</I>
|
|
|
|
<DD>
|
|
system paging device
|
|
<DT id="390"><I>.lsof_hostname</I>
|
|
|
|
<DD>
|
|
<I>lsof's</I>
|
|
|
|
device cache file
|
|
(The suffix,
|
|
<I>hostname</I>,
|
|
|
|
is the first component of the host's name returned by
|
|
<I><A HREF="/cgi-bin/man/man2html?2+gethostname">gethostname</A></I>(2).)
|
|
|
|
</DL>
|
|
<A NAME="lbBB"> </A>
|
|
<H2>AUTHORS</H2>
|
|
|
|
<I>Lsof</I>
|
|
|
|
was written by Victor A.Abell <<A HREF="mailto:abe@purdue.edu">abe@purdue.edu</A>> of Purdue University.
|
|
Many others have contributed to
|
|
<I>lsof</I>.
|
|
|
|
They're listed in the
|
|
<I>00CREDITS</I>
|
|
|
|
file of the
|
|
<I>lsof</I>
|
|
|
|
distribution.
|
|
<A NAME="lbBC"> </A>
|
|
<H2>DISTRIBUTION</H2>
|
|
|
|
The latest distribution of
|
|
<I>lsof</I>
|
|
|
|
is available via anonymous ftp from the host
|
|
<I>lsof.itap.purdue.edu</I>.
|
|
|
|
You'll find the
|
|
<I>lsof</I>
|
|
|
|
distribution in the
|
|
<I>pub/tools/unix/lsof</I>
|
|
|
|
directory.
|
|
<P>
|
|
|
|
You can also use this URL:
|
|
<DL COMPACT>
|
|
<DT id="391"><DD>
|
|
<A HREF="ftp://lsof.itap.purdue.edu/pub/tools/unix/lsof">ftp://lsof.itap.purdue.edu/pub/tools/unix/lsof</A>
|
|
</DL>
|
|
<P>
|
|
|
|
<I>Lsof</I>
|
|
|
|
is also mirrored elsewhere.
|
|
When you access
|
|
<I>lsof.itap.purdue.edu</I>
|
|
|
|
and change to its
|
|
<I>pub/tools/unix/lsof</I>
|
|
|
|
directory, you'll be given a list of some mirror sites.
|
|
The
|
|
<I>pub/tools/unix/lsof</I>
|
|
|
|
directory also contains a more complete list in its
|
|
<I>mirrors</I>
|
|
|
|
file.
|
|
Use mirrors with caution - not all mirrors always have the latest
|
|
<I>lsof</I>
|
|
|
|
revision.
|
|
<P>
|
|
|
|
Some pre-compiled
|
|
<I>Lsof</I>
|
|
|
|
executables are available on
|
|
<I>lsof.itap.purdue.edu</I>,
|
|
|
|
but their use is discouraged - it's better that you build
|
|
your own from the sources.
|
|
If you feel you must use a pre-compiled executable, please
|
|
read the cautions that appear in the README files of the
|
|
<I>pub/tools/unix/lsof/binaries</I>
|
|
|
|
subdirectories and in the 00* files of the distribution.
|
|
<P>
|
|
|
|
More information on the
|
|
<I>lsof</I>
|
|
|
|
distribution can be found in its
|
|
<I>README.lsof_<version></I>
|
|
|
|
file.
|
|
If you intend to get the
|
|
<I>lsof</I>
|
|
|
|
distribution and build it, please read
|
|
<I>README.lsof_<version></I>
|
|
|
|
and the other 00* files of the distribution before sending questions
|
|
to the author.
|
|
<A NAME="lbBD"> </A>
|
|
<H2>SEE ALSO</H2>
|
|
|
|
<P>
|
|
|
|
Not all the following manual pages may exist in every UNIX
|
|
dialect to which
|
|
<I>lsof</I>
|
|
|
|
has been ported.
|
|
<P>
|
|
|
|
<A HREF="/cgi-bin/man/man2html?2+access">access</A>(2),
|
|
<A HREF="/cgi-bin/man/man2html?1+awk">awk</A>(1),
|
|
<A HREF="/cgi-bin/man/man2html?1+crash">crash</A>(1),
|
|
<A HREF="/cgi-bin/man/man2html?3C+fattach">fattach</A>(3C),
|
|
<A HREF="/cgi-bin/man/man2html?1+ff">ff</A>(1),
|
|
<A HREF="/cgi-bin/man/man2html?8+fstat">fstat</A>(8),
|
|
<A HREF="/cgi-bin/man/man2html?1+fuser">fuser</A>(1),
|
|
<A HREF="/cgi-bin/man/man2html?2+gethostname">gethostname</A>(2),
|
|
<A HREF="/cgi-bin/man/man2html?3+isprint">isprint</A>(3),
|
|
<A HREF="/cgi-bin/man/man2html?1+kill">kill</A>(1),
|
|
<A HREF="/cgi-bin/man/man2html?3+localtime">localtime</A>(3),
|
|
<A HREF="/cgi-bin/man/man2html?2+lstat">lstat</A>(2),
|
|
<A HREF="/cgi-bin/man/man2html?8+modload">modload</A>(8),
|
|
<A HREF="/cgi-bin/man/man2html?8+mount">mount</A>(8),
|
|
<A HREF="/cgi-bin/man/man2html?1+netstat">netstat</A>(1),
|
|
<A HREF="/cgi-bin/man/man2html?8L+ofiles">ofiles</A>(8L),
|
|
<A HREF="/cgi-bin/man/man2html?1+perl">perl</A>(1),
|
|
<A HREF="/cgi-bin/man/man2html?1+ps">ps</A>(1),
|
|
<A HREF="/cgi-bin/man/man2html?2+readlink">readlink</A>(2),
|
|
<A HREF="/cgi-bin/man/man2html?3+setlocale">setlocale</A>(3),
|
|
<A HREF="/cgi-bin/man/man2html?2+stat">stat</A>(2),
|
|
<A HREF="/cgi-bin/man/man2html?3+strftime">strftime</A>(3),
|
|
<A HREF="/cgi-bin/man/man2html?2+time">time</A>(2),
|
|
<A HREF="/cgi-bin/man/man2html?1+uname">uname</A>(1).
|
|
<P>
|
|
|
|
<HR>
|
|
<A NAME="index"> </A><H2>Index</H2>
|
|
<DL>
|
|
<DT id="392"><A HREF="#lbAB">NAME</A><DD>
|
|
<DT id="393"><A HREF="#lbAC">SYNOPSIS</A><DD>
|
|
<DT id="394"><A HREF="#lbAD">DESCRIPTION</A><DD>
|
|
<DT id="395"><A HREF="#lbAE">OPTIONS</A><DD>
|
|
<DT id="396"><A HREF="#lbAF">AFS</A><DD>
|
|
<DT id="397"><A HREF="#lbAG">SECURITY</A><DD>
|
|
<DT id="398"><A HREF="#lbAH">OUTPUT</A><DD>
|
|
<DT id="399"><A HREF="#lbAI">LOCKS</A><DD>
|
|
<DT id="400"><A HREF="#lbAJ">OUTPUT FOR OTHER PROGRAMS</A><DD>
|
|
<DT id="401"><A HREF="#lbAK">BLOCKS AND TIMEOUTS</A><DD>
|
|
<DT id="402"><A HREF="#lbAL">AVOIDING KERNEL BLOCKS</A><DD>
|
|
<DT id="403"><A HREF="#lbAM">ALTERNATE DEVICE NUMBERS</A><DD>
|
|
<DT id="404"><A HREF="#lbAN">KERNEL NAME CACHE</A><DD>
|
|
<DT id="405"><A HREF="#lbAO">DEVICE CACHE FILE</A><DD>
|
|
<DT id="406"><A HREF="#lbAP">LSOF PERMISSIONS THAT AFFECT DEVICE CACHE FILE ACCESS</A><DD>
|
|
<DT id="407"><A HREF="#lbAQ">DEVICE CACHE FILE PATH FROM THE -D OPTION</A><DD>
|
|
<DT id="408"><A HREF="#lbAR">DEVICE CACHE PATH FROM AN ENVIRONMENT VARIABLE</A><DD>
|
|
<DT id="409"><A HREF="#lbAS">SYSTEM-WIDE DEVICE CACHE PATH</A><DD>
|
|
<DT id="410"><A HREF="#lbAT">PERSONAL DEVICE CACHE PATH (DEFAULT)</A><DD>
|
|
<DT id="411"><A HREF="#lbAU">MODIFIED PERSONAL DEVICE CACHE PATH</A><DD>
|
|
<DT id="412"><A HREF="#lbAV">DIAGNOSTICS</A><DD>
|
|
<DT id="413"><A HREF="#lbAW">EXAMPLES</A><DD>
|
|
<DT id="414"><A HREF="#lbAX">BUGS</A><DD>
|
|
<DT id="415"><A HREF="#lbAY">ENVIRONMENT</A><DD>
|
|
<DT id="416"><A HREF="#lbAZ">FAQ</A><DD>
|
|
<DT id="417"><A HREF="#lbBA">FILES</A><DD>
|
|
<DT id="418"><A HREF="#lbBB">AUTHORS</A><DD>
|
|
<DT id="419"><A HREF="#lbBC">DISTRIBUTION</A><DD>
|
|
<DT id="420"><A HREF="#lbBD">SEE ALSO</A><DD>
|
|
</DL>
|
|
<HR>
|
|
This document was created by
|
|
<A HREF="/cgi-bin/man/man2html">man2html</A>,
|
|
using the manual pages.<BR>
|
|
Time: 00:06:13 GMT, March 31, 2021
|
|
</BODY>
|
|
</HTML>
|